Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 04:11
Static task
static1
Behavioral task
behavioral1
Sample
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
-
Size
74KB
-
MD5
45c76c1717fe39f6eada9ad5e08eca8b
-
SHA1
dc414caff1bb1b5d15b73e3c32d13a323322fd13
-
SHA256
062bed039cb8d49df104f180a07b13dc5274852d4e5e885159a92008edad7250
-
SHA512
9ca314168aae42205065bbfdc94e589ba0bbb4932c94fb7e4820a7d3f579b275466dd85c83f109614d5b10d6cff42b44f2d7edbd29fa7bf1f52ddfa564bd1834
-
SSDEEP
1536:8mmg2PcY3CfPsraJvnmnt2USxzF7wsSXokv1h/WalxZrT3hmz/ES:8mmTPsfPsraJ+n05xzuYU1Ialn5mzES
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2060 msapi.exe 2780 msapi.exe 2560 msapi.exe 2712 msapi.exe 2804 msapi.exe 2288 msapi.exe 2768 msapi.exe 2616 msapi.exe 2604 msapi.exe 1824 msapi.exe 2980 msapi.exe 2492 msapi.exe 2104 msapi.exe 2172 msapi.exe 1792 msapi.exe 2436 msapi.exe 1808 msapi.exe 2788 msapi.exe 2852 msapi.exe 2848 msapi.exe 892 msapi.exe 764 msapi.exe 1828 msapi.exe 680 msapi.exe 2336 msapi.exe 1520 msapi.exe 572 msapi.exe 1044 msapi.exe 2384 msapi.exe 744 msapi.exe 112 msapi.exe 596 msapi.exe 900 msapi.exe 840 msapi.exe 2728 msapi.exe 1548 msapi.exe 2136 msapi.exe 1488 msapi.exe 1464 msapi.exe 1412 msapi.exe 2268 msapi.exe 2460 msapi.exe 2476 msapi.exe 2140 msapi.exe 2272 msapi.exe 796 msapi.exe 2280 msapi.exe 696 msapi.exe 2948 msapi.exe 1512 msapi.exe 668 msapi.exe 2020 msapi.exe 1684 msapi.exe 2396 msapi.exe 2916 msapi.exe 2836 msapi.exe 2692 msapi.exe 2752 msapi.exe 2756 msapi.exe 2588 msapi.exe 2640 msapi.exe 2844 msapi.exe 2076 msapi.exe 2800 msapi.exe -
Loads dropped DLL 64 IoCs
pid Process 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 2060 msapi.exe 2060 msapi.exe 2780 msapi.exe 2780 msapi.exe 2560 msapi.exe 2560 msapi.exe 2712 msapi.exe 2712 msapi.exe 2804 msapi.exe 2804 msapi.exe 2288 msapi.exe 2288 msapi.exe 2768 msapi.exe 2768 msapi.exe 2616 msapi.exe 2616 msapi.exe 2604 msapi.exe 2604 msapi.exe 1824 msapi.exe 1824 msapi.exe 2980 msapi.exe 2980 msapi.exe 2492 msapi.exe 2492 msapi.exe 2104 msapi.exe 2104 msapi.exe 2172 msapi.exe 2172 msapi.exe 1792 msapi.exe 1792 msapi.exe 2436 msapi.exe 2436 msapi.exe 1808 msapi.exe 1808 msapi.exe 2788 msapi.exe 2788 msapi.exe 2852 msapi.exe 2852 msapi.exe 2848 msapi.exe 2848 msapi.exe 892 msapi.exe 892 msapi.exe 764 msapi.exe 764 msapi.exe 1828 msapi.exe 1828 msapi.exe 680 msapi.exe 680 msapi.exe 2336 msapi.exe 2336 msapi.exe 1520 msapi.exe 1520 msapi.exe 572 msapi.exe 572 msapi.exe 1044 msapi.exe 1044 msapi.exe 2384 msapi.exe 2384 msapi.exe 744 msapi.exe 744 msapi.exe 112 msapi.exe 112 msapi.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File created C:\Windows\SysWOW64\msapi.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2060 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 30 PID 2184 wrote to memory of 2060 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 30 PID 2184 wrote to memory of 2060 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 30 PID 2184 wrote to memory of 2060 2184 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 30 PID 2060 wrote to memory of 2780 2060 msapi.exe 31 PID 2060 wrote to memory of 2780 2060 msapi.exe 31 PID 2060 wrote to memory of 2780 2060 msapi.exe 31 PID 2060 wrote to memory of 2780 2060 msapi.exe 31 PID 2780 wrote to memory of 2560 2780 msapi.exe 32 PID 2780 wrote to memory of 2560 2780 msapi.exe 32 PID 2780 wrote to memory of 2560 2780 msapi.exe 32 PID 2780 wrote to memory of 2560 2780 msapi.exe 32 PID 2560 wrote to memory of 2712 2560 msapi.exe 33 PID 2560 wrote to memory of 2712 2560 msapi.exe 33 PID 2560 wrote to memory of 2712 2560 msapi.exe 33 PID 2560 wrote to memory of 2712 2560 msapi.exe 33 PID 2712 wrote to memory of 2804 2712 msapi.exe 34 PID 2712 wrote to memory of 2804 2712 msapi.exe 34 PID 2712 wrote to memory of 2804 2712 msapi.exe 34 PID 2712 wrote to memory of 2804 2712 msapi.exe 34 PID 2804 wrote to memory of 2288 2804 msapi.exe 35 PID 2804 wrote to memory of 2288 2804 msapi.exe 35 PID 2804 wrote to memory of 2288 2804 msapi.exe 35 PID 2804 wrote to memory of 2288 2804 msapi.exe 35 PID 2288 wrote to memory of 2768 2288 msapi.exe 36 PID 2288 wrote to memory of 2768 2288 msapi.exe 36 PID 2288 wrote to memory of 2768 2288 msapi.exe 36 PID 2288 wrote to memory of 2768 2288 msapi.exe 36 PID 2768 wrote to memory of 2616 2768 msapi.exe 37 PID 2768 wrote to memory of 2616 2768 msapi.exe 37 PID 2768 wrote to memory of 2616 2768 msapi.exe 37 PID 2768 wrote to memory of 2616 2768 msapi.exe 37 PID 2616 wrote to memory of 2604 2616 msapi.exe 38 PID 2616 wrote to memory of 2604 2616 msapi.exe 38 PID 2616 wrote to memory of 2604 2616 msapi.exe 38 PID 2616 wrote to memory of 2604 2616 msapi.exe 38 PID 2604 wrote to memory of 1824 2604 msapi.exe 39 PID 2604 wrote to memory of 1824 2604 msapi.exe 39 PID 2604 wrote to memory of 1824 2604 msapi.exe 39 PID 2604 wrote to memory of 1824 2604 msapi.exe 39 PID 1824 wrote to memory of 2980 1824 msapi.exe 40 PID 1824 wrote to memory of 2980 1824 msapi.exe 40 PID 1824 wrote to memory of 2980 1824 msapi.exe 40 PID 1824 wrote to memory of 2980 1824 msapi.exe 40 PID 2980 wrote to memory of 2492 2980 msapi.exe 41 PID 2980 wrote to memory of 2492 2980 msapi.exe 41 PID 2980 wrote to memory of 2492 2980 msapi.exe 41 PID 2980 wrote to memory of 2492 2980 msapi.exe 41 PID 2492 wrote to memory of 2104 2492 msapi.exe 42 PID 2492 wrote to memory of 2104 2492 msapi.exe 42 PID 2492 wrote to memory of 2104 2492 msapi.exe 42 PID 2492 wrote to memory of 2104 2492 msapi.exe 42 PID 2104 wrote to memory of 2172 2104 msapi.exe 43 PID 2104 wrote to memory of 2172 2104 msapi.exe 43 PID 2104 wrote to memory of 2172 2104 msapi.exe 43 PID 2104 wrote to memory of 2172 2104 msapi.exe 43 PID 2172 wrote to memory of 1792 2172 msapi.exe 44 PID 2172 wrote to memory of 1792 2172 msapi.exe 44 PID 2172 wrote to memory of 1792 2172 msapi.exe 44 PID 2172 wrote to memory of 1792 2172 msapi.exe 44 PID 1792 wrote to memory of 2436 1792 msapi.exe 45 PID 1792 wrote to memory of 2436 1792 msapi.exe 45 PID 1792 wrote to memory of 2436 1792 msapi.exe 45 PID 1792 wrote to memory of 2436 1792 msapi.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe33⤵
- Executes dropped EXE
PID:596 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe34⤵
- Executes dropped EXE
PID:900 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe35⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe36⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe37⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe38⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe40⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe41⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe42⤵
- Executes dropped EXE
PID:2268 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe43⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe44⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe45⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe46⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe47⤵
- Executes dropped EXE
PID:796 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe48⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe49⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe50⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe51⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe52⤵
- Executes dropped EXE
PID:668 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe53⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe54⤵
- Executes dropped EXE
PID:1684 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe55⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe56⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe57⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe58⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe59⤵
- Executes dropped EXE
PID:2752 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe60⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe61⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe62⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe63⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe65⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe66⤵PID:2556
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe67⤵PID:2548
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe68⤵
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe69⤵PID:2520
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe70⤵PID:3008
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe71⤵PID:3024
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe72⤵PID:2880
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe73⤵PID:2960
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe74⤵PID:2200
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe75⤵PID:2316
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe76⤵PID:2312
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe77⤵PID:2428
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe78⤵PID:2244
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe79⤵PID:1920
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe80⤵PID:1876
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe81⤵PID:1868
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe82⤵PID:848
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe83⤵PID:2240
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe84⤵PID:2856
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe85⤵PID:2004
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe86⤵PID:808
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe87⤵PID:2232
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe88⤵PID:2100
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe89⤵PID:2344
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe90⤵PID:1100
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe91⤵PID:2968
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe92⤵PID:2500
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe93⤵PID:2356
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe94⤵PID:1096
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe95⤵PID:2920
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe96⤵PID:1312
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe97⤵PID:1760
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe98⤵PID:1324
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe99⤵PID:1064
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe100⤵PID:1916
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe101⤵PID:524
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe102⤵PID:1992
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe103⤵PID:1924
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe104⤵PID:1932
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe105⤵PID:1368
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe106⤵PID:2248
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe107⤵PID:544
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe108⤵PID:1300
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe109⤵PID:1244
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe110⤵PID:2360
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe111⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe112⤵PID:2660
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe113⤵PID:2176
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe114⤵PID:2700
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe115⤵PID:2792
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe116⤵PID:2688
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe117⤵PID:2772
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe118⤵PID:2596
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe119⤵PID:2672
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe120⤵PID:3020
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe121⤵PID:2984
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-