Analysis
-
max time kernel
143s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe
-
Size
220KB
-
MD5
4513c22a2d12f54c67f84df16a930bd6
-
SHA1
bc410ee0b166f74331ecb13a4cc8ec0bad88cc36
-
SHA256
1552015b034519d05226cb204c5034965264571c8480c0d0ef6b5a472ecbf84c
-
SHA512
e6c200e2981b9b63b35e37c90fa864f157e296e7d16340953d68c36738cb9b6542d390c2a1b9125b8cb79ff79c2b34e0d4af47b7dd3d1dc28ede1e2921a3e5a0
-
SSDEEP
384:jYxWwue/4youZfWkXiWgEiSZexdiHsd2E0S8NrjpWKV:jYx+6dWailEl0iMk6ErkA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3976 VI7271.tmp 1604 VI72CE.tmp 2128 VI730D.tmp 2400 VI735B.tmp 2160 VI739A.tmp 3560 VI73E8.tmp 2424 VI7436.tmp 452 VI7465.tmp 5024 VI74B3.tmp 4960 VI74F1.tmp 2312 VI7530.tmp 824 VI755F.tmp 3676 VI759D.tmp 456 VI75EB.tmp 428 VI762A.tmp 4412 VI7668.tmp 5052 VI76A7.tmp 4428 VI76D6.tmp 4080 VI7705.tmp 2072 VI7733.tmp 380 VI7772.tmp 1568 VI77B0.tmp 3180 VI77EF.tmp 3488 VI783D.tmp 1896 VI78BA.tmp 5080 VI78F9.tmp 4368 VI7966.tmp 4400 VI79A4.tmp 2364 VI79E3.tmp 440 VI7A31.tmp 1208 VI7A70.tmp 1084 VI7ACD.tmp 2900 VI7AED.tmp 3192 VI7B1B.tmp 704 VI7B5A.tmp 992 VI7B98.tmp 2060 VI7BC7.tmp 2148 VI7BF6.tmp 1560 VI7C35.tmp 4912 VI7C64.tmp 1992 VI7C92.tmp 2064 VI7CC1.tmp 4988 VI7CF0.tmp 4052 VI7D0F.tmp 4152 VI7D2F.tmp 4560 VI7D6D.tmp 2280 VI7DBB.tmp 4360 VI7DEA.tmp 4788 VI7E19.tmp 2404 VI7E48.tmp 4804 VI7E77.tmp 3172 VI7E96.tmp 3356 VI7EC5.tmp 3380 VI7EF4.tmp 2924 VI7F23.tmp 1236 VI7F52.tmp 4332 VI7F80.tmp 3472 VI7FCF.tmp 3060 VI7FFD.tmp 2272 VI803C.tmp 4460 VI808A.tmp 1832 VI80C9.tmp 5068 VI80F7.tmp 4348 VI8126.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI9DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIC728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI19CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI2AA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI7F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI8DC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIAB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI2CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIB73A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VID06F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI9673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIA8C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIC5E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIE7DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIEC06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI7D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI84B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI1652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI8889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIAE51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI1345.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI363E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI8BA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIF136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI16CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI99A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIC2D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIFF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIBF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIAB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIABC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIC9A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VID699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIDAA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIE0EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIF29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI7DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIA1ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIB13F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI1FC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI2E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VID0FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI149C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VICC1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VID188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIA6FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIA9DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIA4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIB3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIF80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VI2B70.tmp -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 19560 Process not Found 19560 Process not Found 19560 Process not Found 19560 Process not Found 19528 Process not Found 19528 Process not Found 19528 Process not Found 19528 Process not Found 19496 Process not Found 19496 Process not Found 19496 Process not Found 19496 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 19464 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 13996 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found 3680 Process not Found -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 952 4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe 3976 VI7271.tmp 1604 VI72CE.tmp 2128 VI730D.tmp 2400 VI735B.tmp 2160 VI739A.tmp 3560 VI73E8.tmp 2424 VI7436.tmp 452 VI7465.tmp 5024 VI74B3.tmp 4960 VI74F1.tmp 2312 VI7530.tmp 824 VI755F.tmp 3676 VI759D.tmp 456 VI75EB.tmp 428 VI762A.tmp 4412 VI7668.tmp 5052 VI76A7.tmp 4428 VI76D6.tmp 4080 VI7705.tmp 2072 VI7733.tmp 380 VI7772.tmp 1568 VI77B0.tmp 3180 VI77EF.tmp 3488 VI783D.tmp 1896 VI78BA.tmp 5080 VI78F9.tmp 4368 VI7966.tmp 4400 VI79A4.tmp 2364 VI79E3.tmp 440 VI7A31.tmp 1208 VI7A70.tmp 1084 VI7ACD.tmp 2900 VI7AED.tmp 3192 VI7B1B.tmp 704 VI7B5A.tmp 992 VI7B98.tmp 2060 VI7BC7.tmp 2148 VI7BF6.tmp 1560 VI7C35.tmp 4912 VI7C64.tmp 1992 VI7C92.tmp 2064 VI7CC1.tmp 4988 VI7CF0.tmp 4052 VI7D0F.tmp 4152 VI7D2F.tmp 4560 VI7D6D.tmp 2280 VI7DBB.tmp 4360 VI7DEA.tmp 4788 VI7E19.tmp 2404 VI7E48.tmp 4804 VI7E77.tmp 3172 VI7E96.tmp 3356 VI7EC5.tmp 3380 VI7EF4.tmp 2924 VI7F23.tmp 1236 VI7F52.tmp 4332 VI7F80.tmp 3472 VI7FCF.tmp 3060 VI7FFD.tmp 2272 VI803C.tmp 4460 VI808A.tmp 1832 VI80C9.tmp 5068 VI80F7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 3976 952 4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe 84 PID 952 wrote to memory of 3976 952 4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe 84 PID 952 wrote to memory of 3976 952 4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe 84 PID 3976 wrote to memory of 1604 3976 VI7271.tmp 85 PID 3976 wrote to memory of 1604 3976 VI7271.tmp 85 PID 3976 wrote to memory of 1604 3976 VI7271.tmp 85 PID 1604 wrote to memory of 2128 1604 VI72CE.tmp 86 PID 1604 wrote to memory of 2128 1604 VI72CE.tmp 86 PID 1604 wrote to memory of 2128 1604 VI72CE.tmp 86 PID 2128 wrote to memory of 2400 2128 VI730D.tmp 87 PID 2128 wrote to memory of 2400 2128 VI730D.tmp 87 PID 2128 wrote to memory of 2400 2128 VI730D.tmp 87 PID 2400 wrote to memory of 2160 2400 VI735B.tmp 88 PID 2400 wrote to memory of 2160 2400 VI735B.tmp 88 PID 2400 wrote to memory of 2160 2400 VI735B.tmp 88 PID 2160 wrote to memory of 3560 2160 VI739A.tmp 89 PID 2160 wrote to memory of 3560 2160 VI739A.tmp 89 PID 2160 wrote to memory of 3560 2160 VI739A.tmp 89 PID 3560 wrote to memory of 2424 3560 VI73E8.tmp 90 PID 3560 wrote to memory of 2424 3560 VI73E8.tmp 90 PID 3560 wrote to memory of 2424 3560 VI73E8.tmp 90 PID 2424 wrote to memory of 452 2424 VI7436.tmp 92 PID 2424 wrote to memory of 452 2424 VI7436.tmp 92 PID 2424 wrote to memory of 452 2424 VI7436.tmp 92 PID 452 wrote to memory of 5024 452 VI7465.tmp 94 PID 452 wrote to memory of 5024 452 VI7465.tmp 94 PID 452 wrote to memory of 5024 452 VI7465.tmp 94 PID 5024 wrote to memory of 4960 5024 VI74B3.tmp 95 PID 5024 wrote to memory of 4960 5024 VI74B3.tmp 95 PID 5024 wrote to memory of 4960 5024 VI74B3.tmp 95 PID 4960 wrote to memory of 2312 4960 VI74F1.tmp 96 PID 4960 wrote to memory of 2312 4960 VI74F1.tmp 96 PID 4960 wrote to memory of 2312 4960 VI74F1.tmp 96 PID 2312 wrote to memory of 824 2312 VI7530.tmp 97 PID 2312 wrote to memory of 824 2312 VI7530.tmp 97 PID 2312 wrote to memory of 824 2312 VI7530.tmp 97 PID 824 wrote to memory of 3676 824 VI755F.tmp 98 PID 824 wrote to memory of 3676 824 VI755F.tmp 98 PID 824 wrote to memory of 3676 824 VI755F.tmp 98 PID 3676 wrote to memory of 456 3676 VI759D.tmp 100 PID 3676 wrote to memory of 456 3676 VI759D.tmp 100 PID 3676 wrote to memory of 456 3676 VI759D.tmp 100 PID 456 wrote to memory of 428 456 VI75EB.tmp 101 PID 456 wrote to memory of 428 456 VI75EB.tmp 101 PID 456 wrote to memory of 428 456 VI75EB.tmp 101 PID 428 wrote to memory of 4412 428 VI762A.tmp 102 PID 428 wrote to memory of 4412 428 VI762A.tmp 102 PID 428 wrote to memory of 4412 428 VI762A.tmp 102 PID 4412 wrote to memory of 5052 4412 VI7668.tmp 103 PID 4412 wrote to memory of 5052 4412 VI7668.tmp 103 PID 4412 wrote to memory of 5052 4412 VI7668.tmp 103 PID 5052 wrote to memory of 4428 5052 VI76A7.tmp 104 PID 5052 wrote to memory of 4428 5052 VI76A7.tmp 104 PID 5052 wrote to memory of 4428 5052 VI76A7.tmp 104 PID 4428 wrote to memory of 4080 4428 VI76D6.tmp 105 PID 4428 wrote to memory of 4080 4428 VI76D6.tmp 105 PID 4428 wrote to memory of 4080 4428 VI76D6.tmp 105 PID 4080 wrote to memory of 2072 4080 VI7705.tmp 106 PID 4080 wrote to memory of 2072 4080 VI7705.tmp 106 PID 4080 wrote to memory of 2072 4080 VI7705.tmp 106 PID 2072 wrote to memory of 380 2072 VI7733.tmp 107 PID 2072 wrote to memory of 380 2072 VI7733.tmp 107 PID 2072 wrote to memory of 380 2072 VI7733.tmp 107 PID 380 wrote to memory of 1568 380 VI7772.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4513c22a2d12f54c67f84df16a930bd6_JaffaCakes118.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\VI7271.tmpC:\Users\Admin\AppData\Local\Temp\VI7271.tmp2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\VI72CE.tmpC:\Users\Admin\AppData\Local\Temp\VI72CE.tmp3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\VI730D.tmpC:\Users\Admin\AppData\Local\Temp\VI730D.tmp4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\VI735B.tmpC:\Users\Admin\AppData\Local\Temp\VI735B.tmp5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\VI739A.tmpC:\Users\Admin\AppData\Local\Temp\VI739A.tmp6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\VI73E8.tmpC:\Users\Admin\AppData\Local\Temp\VI73E8.tmp7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\VI7436.tmpC:\Users\Admin\AppData\Local\Temp\VI7436.tmp8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\VI7465.tmpC:\Users\Admin\AppData\Local\Temp\VI7465.tmp9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\VI74B3.tmpC:\Users\Admin\AppData\Local\Temp\VI74B3.tmp10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\VI74F1.tmpC:\Users\Admin\AppData\Local\Temp\VI74F1.tmp11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\VI7530.tmpC:\Users\Admin\AppData\Local\Temp\VI7530.tmp12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\VI755F.tmpC:\Users\Admin\AppData\Local\Temp\VI755F.tmp13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\VI759D.tmpC:\Users\Admin\AppData\Local\Temp\VI759D.tmp14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\VI75EB.tmpC:\Users\Admin\AppData\Local\Temp\VI75EB.tmp15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\VI762A.tmpC:\Users\Admin\AppData\Local\Temp\VI762A.tmp16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\VI7668.tmpC:\Users\Admin\AppData\Local\Temp\VI7668.tmp17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\VI76A7.tmpC:\Users\Admin\AppData\Local\Temp\VI76A7.tmp18⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\VI76D6.tmpC:\Users\Admin\AppData\Local\Temp\VI76D6.tmp19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\VI7705.tmpC:\Users\Admin\AppData\Local\Temp\VI7705.tmp20⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\VI7733.tmpC:\Users\Admin\AppData\Local\Temp\VI7733.tmp21⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\VI7772.tmpC:\Users\Admin\AppData\Local\Temp\VI7772.tmp22⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\VI77B0.tmpC:\Users\Admin\AppData\Local\Temp\VI77B0.tmp23⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\VI77EF.tmpC:\Users\Admin\AppData\Local\Temp\VI77EF.tmp24⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\VI783D.tmpC:\Users\Admin\AppData\Local\Temp\VI783D.tmp25⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\VI78BA.tmpC:\Users\Admin\AppData\Local\Temp\VI78BA.tmp26⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\VI78F9.tmpC:\Users\Admin\AppData\Local\Temp\VI78F9.tmp27⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\VI7966.tmpC:\Users\Admin\AppData\Local\Temp\VI7966.tmp28⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\VI79A4.tmpC:\Users\Admin\AppData\Local\Temp\VI79A4.tmp29⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\VI79E3.tmpC:\Users\Admin\AppData\Local\Temp\VI79E3.tmp30⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\VI7A31.tmpC:\Users\Admin\AppData\Local\Temp\VI7A31.tmp31⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:440 -
C:\Users\Admin\AppData\Local\Temp\VI7A70.tmpC:\Users\Admin\AppData\Local\Temp\VI7A70.tmp32⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\VI7ACD.tmpC:\Users\Admin\AppData\Local\Temp\VI7ACD.tmp33⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\VI7AED.tmpC:\Users\Admin\AppData\Local\Temp\VI7AED.tmp34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\VI7B1B.tmpC:\Users\Admin\AppData\Local\Temp\VI7B1B.tmp35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\VI7B5A.tmpC:\Users\Admin\AppData\Local\Temp\VI7B5A.tmp36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:704 -
C:\Users\Admin\AppData\Local\Temp\VI7B98.tmpC:\Users\Admin\AppData\Local\Temp\VI7B98.tmp37⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:992 -
C:\Users\Admin\AppData\Local\Temp\VI7BC7.tmpC:\Users\Admin\AppData\Local\Temp\VI7BC7.tmp38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\VI7BF6.tmpC:\Users\Admin\AppData\Local\Temp\VI7BF6.tmp39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\VI7C35.tmpC:\Users\Admin\AppData\Local\Temp\VI7C35.tmp40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\VI7C64.tmpC:\Users\Admin\AppData\Local\Temp\VI7C64.tmp41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\VI7C92.tmpC:\Users\Admin\AppData\Local\Temp\VI7C92.tmp42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\VI7CC1.tmpC:\Users\Admin\AppData\Local\Temp\VI7CC1.tmp43⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\VI7CF0.tmpC:\Users\Admin\AppData\Local\Temp\VI7CF0.tmp44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\VI7D0F.tmpC:\Users\Admin\AppData\Local\Temp\VI7D0F.tmp45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\VI7D2F.tmpC:\Users\Admin\AppData\Local\Temp\VI7D2F.tmp46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\VI7D6D.tmpC:\Users\Admin\AppData\Local\Temp\VI7D6D.tmp47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\VI7DBB.tmpC:\Users\Admin\AppData\Local\Temp\VI7DBB.tmp48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\VI7DEA.tmpC:\Users\Admin\AppData\Local\Temp\VI7DEA.tmp49⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\VI7E19.tmpC:\Users\Admin\AppData\Local\Temp\VI7E19.tmp50⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\VI7E48.tmpC:\Users\Admin\AppData\Local\Temp\VI7E48.tmp51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\VI7E77.tmpC:\Users\Admin\AppData\Local\Temp\VI7E77.tmp52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\VI7E96.tmpC:\Users\Admin\AppData\Local\Temp\VI7E96.tmp53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\VI7EC5.tmpC:\Users\Admin\AppData\Local\Temp\VI7EC5.tmp54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\VI7EF4.tmpC:\Users\Admin\AppData\Local\Temp\VI7EF4.tmp55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\VI7F23.tmpC:\Users\Admin\AppData\Local\Temp\VI7F23.tmp56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\VI7F52.tmpC:\Users\Admin\AppData\Local\Temp\VI7F52.tmp57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\VI7F80.tmpC:\Users\Admin\AppData\Local\Temp\VI7F80.tmp58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\VI7FCF.tmpC:\Users\Admin\AppData\Local\Temp\VI7FCF.tmp59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\VI7FFD.tmpC:\Users\Admin\AppData\Local\Temp\VI7FFD.tmp60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\VI803C.tmpC:\Users\Admin\AppData\Local\Temp\VI803C.tmp61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\VI808A.tmpC:\Users\Admin\AppData\Local\Temp\VI808A.tmp62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\VI80C9.tmpC:\Users\Admin\AppData\Local\Temp\VI80C9.tmp63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\VI80F7.tmpC:\Users\Admin\AppData\Local\Temp\VI80F7.tmp64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\VI8126.tmpC:\Users\Admin\AppData\Local\Temp\VI8126.tmp65⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\VI8155.tmpC:\Users\Admin\AppData\Local\Temp\VI8155.tmp66⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\VI8194.tmpC:\Users\Admin\AppData\Local\Temp\VI8194.tmp67⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\VI81C3.tmpC:\Users\Admin\AppData\Local\Temp\VI81C3.tmp68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\VI8201.tmpC:\Users\Admin\AppData\Local\Temp\VI8201.tmp69⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\VI8230.tmpC:\Users\Admin\AppData\Local\Temp\VI8230.tmp70⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\VI824F.tmpC:\Users\Admin\AppData\Local\Temp\VI824F.tmp71⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\VI828E.tmpC:\Users\Admin\AppData\Local\Temp\VI828E.tmp72⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\VI82AD.tmpC:\Users\Admin\AppData\Local\Temp\VI82AD.tmp73⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\VI82CC.tmpC:\Users\Admin\AppData\Local\Temp\VI82CC.tmp74⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\VI82FB.tmpC:\Users\Admin\AppData\Local\Temp\VI82FB.tmp75⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\VI832A.tmpC:\Users\Admin\AppData\Local\Temp\VI832A.tmp76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\VI8359.tmpC:\Users\Admin\AppData\Local\Temp\VI8359.tmp77⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\VI8388.tmpC:\Users\Admin\AppData\Local\Temp\VI8388.tmp78⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\VI83A7.tmpC:\Users\Admin\AppData\Local\Temp\VI83A7.tmp79⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\VI83D6.tmpC:\Users\Admin\AppData\Local\Temp\VI83D6.tmp80⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\VI83F5.tmpC:\Users\Admin\AppData\Local\Temp\VI83F5.tmp81⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\VI8434.tmpC:\Users\Admin\AppData\Local\Temp\VI8434.tmp82⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\VI8482.tmpC:\Users\Admin\AppData\Local\Temp\VI8482.tmp83⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\VI84B1.tmpC:\Users\Admin\AppData\Local\Temp\VI84B1.tmp84⤵
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\VI853D.tmpC:\Users\Admin\AppData\Local\Temp\VI853D.tmp85⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\VI857C.tmpC:\Users\Admin\AppData\Local\Temp\VI857C.tmp86⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\VI85AB.tmpC:\Users\Admin\AppData\Local\Temp\VI85AB.tmp87⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\VI85E9.tmpC:\Users\Admin\AppData\Local\Temp\VI85E9.tmp88⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\VI8618.tmpC:\Users\Admin\AppData\Local\Temp\VI8618.tmp89⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\VI8647.tmpC:\Users\Admin\AppData\Local\Temp\VI8647.tmp90⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\VI8676.tmpC:\Users\Admin\AppData\Local\Temp\VI8676.tmp91⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\VI86B4.tmpC:\Users\Admin\AppData\Local\Temp\VI86B4.tmp92⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\VI86D3.tmpC:\Users\Admin\AppData\Local\Temp\VI86D3.tmp93⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\VI8712.tmpC:\Users\Admin\AppData\Local\Temp\VI8712.tmp94⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\VI8741.tmpC:\Users\Admin\AppData\Local\Temp\VI8741.tmp95⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\VI8770.tmpC:\Users\Admin\AppData\Local\Temp\VI8770.tmp96⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\VI879F.tmpC:\Users\Admin\AppData\Local\Temp\VI879F.tmp97⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\VI87CD.tmpC:\Users\Admin\AppData\Local\Temp\VI87CD.tmp98⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\VI87FC.tmpC:\Users\Admin\AppData\Local\Temp\VI87FC.tmp99⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\VI882B.tmpC:\Users\Admin\AppData\Local\Temp\VI882B.tmp100⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\VI885A.tmpC:\Users\Admin\AppData\Local\Temp\VI885A.tmp101⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\VI8889.tmpC:\Users\Admin\AppData\Local\Temp\VI8889.tmp102⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\VI88B8.tmpC:\Users\Admin\AppData\Local\Temp\VI88B8.tmp103⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\VI88E7.tmpC:\Users\Admin\AppData\Local\Temp\VI88E7.tmp104⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\VI8925.tmpC:\Users\Admin\AppData\Local\Temp\VI8925.tmp105⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\VI8954.tmpC:\Users\Admin\AppData\Local\Temp\VI8954.tmp106⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\VI8983.tmpC:\Users\Admin\AppData\Local\Temp\VI8983.tmp107⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\VI89B2.tmpC:\Users\Admin\AppData\Local\Temp\VI89B2.tmp108⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\VI89E1.tmpC:\Users\Admin\AppData\Local\Temp\VI89E1.tmp109⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\VI8A10.tmpC:\Users\Admin\AppData\Local\Temp\VI8A10.tmp110⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\VI8A3E.tmpC:\Users\Admin\AppData\Local\Temp\VI8A3E.tmp111⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\VI8A6D.tmpC:\Users\Admin\AppData\Local\Temp\VI8A6D.tmp112⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\VI8A9C.tmpC:\Users\Admin\AppData\Local\Temp\VI8A9C.tmp113⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\VI8ADB.tmpC:\Users\Admin\AppData\Local\Temp\VI8ADB.tmp114⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\VI8B0A.tmpC:\Users\Admin\AppData\Local\Temp\VI8B0A.tmp115⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\VI8B48.tmpC:\Users\Admin\AppData\Local\Temp\VI8B48.tmp116⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\VI8B77.tmpC:\Users\Admin\AppData\Local\Temp\VI8B77.tmp117⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\VI8BA6.tmpC:\Users\Admin\AppData\Local\Temp\VI8BA6.tmp118⤵
- System Location Discovery: System Language Discovery
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\VI8BD5.tmpC:\Users\Admin\AppData\Local\Temp\VI8BD5.tmp119⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\VI8C04.tmpC:\Users\Admin\AppData\Local\Temp\VI8C04.tmp120⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\VI8C42.tmpC:\Users\Admin\AppData\Local\Temp\VI8C42.tmp121⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\VI8C71.tmpC:\Users\Admin\AppData\Local\Temp\VI8C71.tmp122⤵PID:5940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-