Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe
-
Size
244KB
-
MD5
ff2c87c458cecdf0ff84ed2cc6f01fe9
-
SHA1
fe5191103e09af59fbf8a001911d227f067b0c4e
-
SHA256
f908292a20405e060595e9a0447e897b04d2da21b4dd1b9878322463439e9b09
-
SHA512
57d6324af7cb162f7624742c8b2ae9ea5f85582f9420034f105a28f3b5d2135d574192ce01607cb55bc68a82fed86e9a201b560a2f701df0236c0a6fad4ad7fc
-
SSDEEP
3072:fn1zwLyYuAXyeaTFbkEg1Qp1o1zwLvKAP3G9:fn1zNWUZbkFQp1o1zmPa
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 64 IoCs
pid Process 852 userinit.exe 2596 system.exe 3664 system.exe 2960 system.exe 4392 system.exe 1304 system.exe 3588 system.exe 4544 system.exe 2396 system.exe 4556 system.exe 1276 system.exe 3176 system.exe 5064 system.exe 4580 system.exe 5092 system.exe 3468 system.exe 1456 system.exe 1984 system.exe 4420 system.exe 4820 system.exe 4488 system.exe 1752 system.exe 3916 system.exe 4624 system.exe 1180 system.exe 1332 system.exe 2748 system.exe 3588 system.exe 4784 system.exe 2016 system.exe 2448 system.exe 540 system.exe 4944 system.exe 2848 system.exe 3456 system.exe 1736 system.exe 4504 system.exe 2788 system.exe 4440 system.exe 2992 system.exe 2664 system.exe 4640 system.exe 1808 system.exe 2872 system.exe 2724 system.exe 3128 system.exe 4840 system.exe 2976 system.exe 4116 system.exe 5048 system.exe 2060 system.exe 2472 system.exe 1972 system.exe 4784 system.exe 4608 system.exe 4340 system.exe 4808 system.exe 388 system.exe 4000 system.exe 1280 system.exe 1256 system.exe 3676 system.exe 4372 system.exe 4504 system.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\userinit.exe ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe File opened for modification C:\Windows\userinit.exe ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe File created C:\Windows\kdcoms.dll userinit.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 852 userinit.exe 852 userinit.exe 852 userinit.exe 852 userinit.exe 2596 system.exe 2596 system.exe 852 userinit.exe 852 userinit.exe 3664 system.exe 3664 system.exe 852 userinit.exe 852 userinit.exe 2960 system.exe 2960 system.exe 852 userinit.exe 852 userinit.exe 4392 system.exe 4392 system.exe 852 userinit.exe 852 userinit.exe 1304 system.exe 1304 system.exe 852 userinit.exe 852 userinit.exe 3588 system.exe 3588 system.exe 852 userinit.exe 852 userinit.exe 4544 system.exe 4544 system.exe 852 userinit.exe 852 userinit.exe 2396 system.exe 2396 system.exe 852 userinit.exe 852 userinit.exe 4556 system.exe 4556 system.exe 852 userinit.exe 852 userinit.exe 1276 system.exe 1276 system.exe 852 userinit.exe 852 userinit.exe 3176 system.exe 3176 system.exe 852 userinit.exe 852 userinit.exe 5064 system.exe 5064 system.exe 852 userinit.exe 852 userinit.exe 4580 system.exe 4580 system.exe 852 userinit.exe 852 userinit.exe 5092 system.exe 5092 system.exe 852 userinit.exe 852 userinit.exe 3468 system.exe 3468 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 852 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 852 userinit.exe 852 userinit.exe 2596 system.exe 2596 system.exe 3664 system.exe 3664 system.exe 2960 system.exe 2960 system.exe 4392 system.exe 4392 system.exe 1304 system.exe 1304 system.exe 3588 system.exe 3588 system.exe 4544 system.exe 4544 system.exe 2396 system.exe 2396 system.exe 4556 system.exe 4556 system.exe 1276 system.exe 1276 system.exe 3176 system.exe 3176 system.exe 5064 system.exe 5064 system.exe 4580 system.exe 4580 system.exe 5092 system.exe 5092 system.exe 3468 system.exe 3468 system.exe 1456 system.exe 1456 system.exe 1984 system.exe 1984 system.exe 4420 system.exe 4420 system.exe 4820 system.exe 4820 system.exe 4488 system.exe 4488 system.exe 1752 system.exe 1752 system.exe 3916 system.exe 3916 system.exe 4624 system.exe 4624 system.exe 1180 system.exe 1180 system.exe 1332 system.exe 1332 system.exe 2748 system.exe 2748 system.exe 3588 system.exe 3588 system.exe 4784 system.exe 4784 system.exe 2016 system.exe 2016 system.exe 2448 system.exe 2448 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 852 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 89 PID 2956 wrote to memory of 852 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 89 PID 2956 wrote to memory of 852 2956 ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe 89 PID 852 wrote to memory of 2596 852 userinit.exe 90 PID 852 wrote to memory of 2596 852 userinit.exe 90 PID 852 wrote to memory of 2596 852 userinit.exe 90 PID 852 wrote to memory of 3664 852 userinit.exe 91 PID 852 wrote to memory of 3664 852 userinit.exe 91 PID 852 wrote to memory of 3664 852 userinit.exe 91 PID 852 wrote to memory of 2960 852 userinit.exe 92 PID 852 wrote to memory of 2960 852 userinit.exe 92 PID 852 wrote to memory of 2960 852 userinit.exe 92 PID 852 wrote to memory of 4392 852 userinit.exe 93 PID 852 wrote to memory of 4392 852 userinit.exe 93 PID 852 wrote to memory of 4392 852 userinit.exe 93 PID 852 wrote to memory of 1304 852 userinit.exe 94 PID 852 wrote to memory of 1304 852 userinit.exe 94 PID 852 wrote to memory of 1304 852 userinit.exe 94 PID 852 wrote to memory of 3588 852 userinit.exe 96 PID 852 wrote to memory of 3588 852 userinit.exe 96 PID 852 wrote to memory of 3588 852 userinit.exe 96 PID 852 wrote to memory of 4544 852 userinit.exe 97 PID 852 wrote to memory of 4544 852 userinit.exe 97 PID 852 wrote to memory of 4544 852 userinit.exe 97 PID 852 wrote to memory of 2396 852 userinit.exe 98 PID 852 wrote to memory of 2396 852 userinit.exe 98 PID 852 wrote to memory of 2396 852 userinit.exe 98 PID 852 wrote to memory of 4556 852 userinit.exe 101 PID 852 wrote to memory of 4556 852 userinit.exe 101 PID 852 wrote to memory of 4556 852 userinit.exe 101 PID 852 wrote to memory of 1276 852 userinit.exe 104 PID 852 wrote to memory of 1276 852 userinit.exe 104 PID 852 wrote to memory of 1276 852 userinit.exe 104 PID 852 wrote to memory of 3176 852 userinit.exe 105 PID 852 wrote to memory of 3176 852 userinit.exe 105 PID 852 wrote to memory of 3176 852 userinit.exe 105 PID 852 wrote to memory of 5064 852 userinit.exe 106 PID 852 wrote to memory of 5064 852 userinit.exe 106 PID 852 wrote to memory of 5064 852 userinit.exe 106 PID 852 wrote to memory of 4580 852 userinit.exe 108 PID 852 wrote to memory of 4580 852 userinit.exe 108 PID 852 wrote to memory of 4580 852 userinit.exe 108 PID 852 wrote to memory of 5092 852 userinit.exe 109 PID 852 wrote to memory of 5092 852 userinit.exe 109 PID 852 wrote to memory of 5092 852 userinit.exe 109 PID 852 wrote to memory of 3468 852 userinit.exe 112 PID 852 wrote to memory of 3468 852 userinit.exe 112 PID 852 wrote to memory of 3468 852 userinit.exe 112 PID 852 wrote to memory of 1456 852 userinit.exe 113 PID 852 wrote to memory of 1456 852 userinit.exe 113 PID 852 wrote to memory of 1456 852 userinit.exe 113 PID 852 wrote to memory of 1984 852 userinit.exe 114 PID 852 wrote to memory of 1984 852 userinit.exe 114 PID 852 wrote to memory of 1984 852 userinit.exe 114 PID 852 wrote to memory of 4420 852 userinit.exe 115 PID 852 wrote to memory of 4420 852 userinit.exe 115 PID 852 wrote to memory of 4420 852 userinit.exe 115 PID 852 wrote to memory of 4820 852 userinit.exe 116 PID 852 wrote to memory of 4820 852 userinit.exe 116 PID 852 wrote to memory of 4820 852 userinit.exe 116 PID 852 wrote to memory of 4488 852 userinit.exe 117 PID 852 wrote to memory of 4488 852 userinit.exe 117 PID 852 wrote to memory of 4488 852 userinit.exe 117 PID 852 wrote to memory of 1752 852 userinit.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff2c87c458cecdf0ff84ed2cc6f01fe9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3664
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3588
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4544
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4556
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1276
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3176
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4580
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3468
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3916
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1332
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3588
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:540
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4944
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2788
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2992
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1808
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2872
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3128
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4840
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2976
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4116
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:5048
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2472
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4608
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4808
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1256
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4372
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4504
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4248
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4432
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3268
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4848
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2128
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3652
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:5080
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4652
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:332
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4476
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2252
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2152
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2396
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3008
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:376
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3172
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2120
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:8
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4580
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:5084
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1736
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:5024
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4980
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4248
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4948
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1152
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3640
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3268
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1160
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3700
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4112
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4792
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3524
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3996
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2220
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:332
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:644
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:3864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2512
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2236
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2164
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1860
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1032
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2120
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:5064
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4332
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4692
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4208
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:4528
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:5012
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2296
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3044
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:5096
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:4516
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- System Location Discovery: System Language Discovery
PID:2520
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:81⤵PID:4692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD5ff2c87c458cecdf0ff84ed2cc6f01fe9
SHA1fe5191103e09af59fbf8a001911d227f067b0c4e
SHA256f908292a20405e060595e9a0447e897b04d2da21b4dd1b9878322463439e9b09
SHA51257d6324af7cb162f7624742c8b2ae9ea5f85582f9420034f105a28f3b5d2135d574192ce01607cb55bc68a82fed86e9a201b560a2f701df0236c0a6fad4ad7fc