xtremerat | 3b502edbf977c5a629a89dca66683d9f3c79588b47dcf4177fc492fe01187c43

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Size

457KB
MD5

4af88ef4a6ceca1e24db838015deac2b
SHA1

b0a62cf9928e8d6a424b4d2c962feb127ae0ab5a
SHA256

3b502edbf977c5a629a89dca66683d9f3c79588b47dcf4177fc492fe01187c43
SHA512

8ea3197dc05832b8be3de4b4900af76d989bbbc7645f81966fecfafba3d6acddd79b649037c7169ba4f702d0fdb14d7ec6cd5c460e3b6c5e70dabf64bbe39d3b
SSDEEP

12288:ptCM7BwSFbDUbQqX4l/DfTLZI0l+8Euui04MQp:pNbiX4ljACPfdp

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Server.exe

Executes dropped EXE 49 IoCs

pid	Process
1692	Server.exe
1336	Server.exe
1000	Server.exe
1156	Server.exe
524	Server.exe
4304	Server.exe
2956	Server.exe
4424	Server.exe
2448	Server.exe
64	Server.exe
4348	Server.exe
3392	Server.exe
2872	Server.exe
4992	Server.exe
1092	Server.exe
4972	Server.exe
3652	Server.exe
464	Server.exe
588	Server.exe
3244	Server.exe
5012	Server.exe
3628	Server.exe
1940	Server.exe
752	Server.exe
1660	Server.exe
5112	Server.exe
588	Server.exe
5100	Server.exe
1432	Server.exe
3580	Server.exe
448	Server.exe
4512	Server.exe
3588	Server.exe
3752	Server.exe
2736	Server.exe
548	Server.exe
4460	Server.exe
3200	Server.exe
3348	Server.exe
308	Server.exe
2628	Server.exe
2908	Server.exe
3524	Server.exe
3424	Server.exe
2384	Server.exe
1804	Server.exe
1416	Server.exe
2540	Server.exe
4860	Server.exe

Loads dropped DLL 64 IoCs

pid	Process
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
1692	Server.exe
1692	Server.exe
1692	Server.exe
1692	Server.exe
1692	Server.exe
1692	Server.exe
1692	Server.exe
1336	Server.exe
1336	Server.exe
1336	Server.exe
1336	Server.exe
1336	Server.exe
1336	Server.exe
1336	Server.exe
524	Server.exe
524	Server.exe
524	Server.exe
524	Server.exe
524	Server.exe
524	Server.exe
524	Server.exe
4424	Server.exe
4424	Server.exe
4424	Server.exe
4424	Server.exe
4424	Server.exe
4424	Server.exe
4424	Server.exe
4348	Server.exe
4348	Server.exe
4348	Server.exe
4348	Server.exe
4348	Server.exe
4348	Server.exe
4348	Server.exe
4992	Server.exe
4992	Server.exe
4992	Server.exe
4992	Server.exe
4992	Server.exe
4992	Server.exe
4992	Server.exe
3652	Server.exe
3652	Server.exe
3652	Server.exe
3652	Server.exe
3652	Server.exe
3652	Server.exe
3652	Server.exe
3244	Server.exe
3244	Server.exe
3244	Server.exe
3244	Server.exe
3244	Server.exe
3244	Server.exe
3244	Server.exe
1940	Server.exe

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{D09FB2FC-118A-4369-8C6E-96FE8A0D4298} = "C:\\Users\\Admin\\AppData\\Roaming\\{D09FB2FC-118A-4369-8C6E-96FE8A0D4298}\\svchost.exe"	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe"	Server.exe

Suspicious use of SetThreadContext 40 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 4148 set thread context of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 1692 set thread context of 1000	1692	Server.exe	133
PID 1000 set thread context of 1156	1000	Server.exe	134
PID 1156 set thread context of 2632	1156	Server.exe	136
PID 524 set thread context of 4304	524	Server.exe	143
PID 4304 set thread context of 2956	4304	Server.exe	144
PID 4424 set thread context of 2448	4424	Server.exe	170
PID 2448 set thread context of 64	2448	Server.exe	173
PID 4348 set thread context of 3392	4348	Server.exe	193
PID 3392 set thread context of 2872	3392	Server.exe	194
PID 2872 set thread context of 4868	2872	Server.exe	196
PID 4992 set thread context of 1092	4992	Server.exe	198
PID 1092 set thread context of 4972	1092	Server.exe	199
PID 3652 set thread context of 464	3652	Server.exe	223
PID 464 set thread context of 588	464	Server.exe	226
PID 3244 set thread context of 5012	3244	Server.exe	248
PID 5012 set thread context of 3628	5012	Server.exe	249
PID 3628 set thread context of 3464	3628	Server.exe	251
PID 1940 set thread context of 752	1940	Server.exe	253
PID 752 set thread context of 1660	752	Server.exe	254
PID 5112 set thread context of 588	5112	Server.exe	278
PID 588 set thread context of 5100	588	Server.exe	280
PID 1432 set thread context of 3580	1432	Server.exe	301
PID 3580 set thread context of 448	3580	Server.exe	302
PID 448 set thread context of 3644	448	Server.exe	304
PID 4512 set thread context of 3588	4512	Server.exe	310
PID 3588 set thread context of 3752	3588	Server.exe	311
PID 2736 set thread context of 548	2736	Server.exe	338
PID 548 set thread context of 4460	548	Server.exe	343
PID 3200 set thread context of 3348	3200	Server.exe	361
PID 3348 set thread context of 308	3348	Server.exe	362
PID 308 set thread context of 2800	308	Server.exe	364
PID 2628 set thread context of 2908	2628	Server.exe	366
PID 2908 set thread context of 3524	2908	Server.exe	367
PID 3424 set thread context of 2384	3424	Server.exe	391
PID 2384 set thread context of 1804	2384	Server.exe	394
PID 1416 set thread context of 2540	1416	Server.exe	417
PID 2540 set thread context of 4860	2540	Server.exe	418
PID 4860 set thread context of 632	4860	Server.exe	420

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2632-124-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-126-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-125-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-128-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-129-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-130-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-131-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-133-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-135-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-134-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-138-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/2632-139-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4868-256-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4868-257-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4868-255-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4868-259-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4868-258-0x0000000001610000-0x0000000001715000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\Server.exe	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
File created	C:\Windows\InstallDir\Server.exe	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3436	1336	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000b000000023b8b-54.dat	nsis_installer_1
behavioral2/files/0x000b000000023b8b-54.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	explorer.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2632	explorer.exe
2632	explorer.exe
4868	explorer.exe
4868	explorer.exe
3464	explorer.exe
3464	explorer.exe
3644	explorer.exe
3644	explorer.exe
2800	explorer.exe
2800	explorer.exe
632	explorer.exe
632	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
2632	explorer.exe
2956	Server.exe
4868	explorer.exe
4972	Server.exe
3464	explorer.exe
1660	Server.exe
3644	explorer.exe
3752	Server.exe
2800	explorer.exe
3524	Server.exe
632	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 2396 wrote to memory of 4148	2396	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	89
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 4148 wrote to memory of 2056	4148	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	90
PID 2056 wrote to memory of 1520	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	91
PID 2056 wrote to memory of 1520	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	91
PID 2056 wrote to memory of 1520	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	91
PID 2056 wrote to memory of 1520	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	91
PID 2056 wrote to memory of 4840	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	92
PID 2056 wrote to memory of 4840	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	92
PID 2056 wrote to memory of 948	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	93
PID 2056 wrote to memory of 948	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	93
PID 2056 wrote to memory of 948	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	93
PID 2056 wrote to memory of 5100	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	96
PID 2056 wrote to memory of 5100	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	96
PID 2056 wrote to memory of 5012	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	97
PID 2056 wrote to memory of 5012	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	97
PID 2056 wrote to memory of 5012	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	97
PID 2056 wrote to memory of 4812	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	98
PID 2056 wrote to memory of 4812	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	98
PID 2056 wrote to memory of 4780	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	99
PID 2056 wrote to memory of 4780	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	99
PID 2056 wrote to memory of 4780	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	99
PID 2056 wrote to memory of 4332	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	100
PID 2056 wrote to memory of 4332	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	100
PID 2056 wrote to memory of 2756	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	101
PID 2056 wrote to memory of 2756	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	101
PID 2056 wrote to memory of 2756	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	101
PID 2056 wrote to memory of 3904	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	102
PID 2056 wrote to memory of 3904	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	102
PID 2056 wrote to memory of 396	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	103
PID 2056 wrote to memory of 396	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	103
PID 2056 wrote to memory of 396	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	103
PID 2056 wrote to memory of 3144	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	104
PID 2056 wrote to memory of 3144	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	104
PID 2056 wrote to memory of 4088	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	105
PID 2056 wrote to memory of 4088	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	105
PID 2056 wrote to memory of 4088	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	105
PID 2056 wrote to memory of 660	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	106
PID 2056 wrote to memory of 660	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	106
PID 2056 wrote to memory of 3360	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	107
PID 2056 wrote to memory of 3360	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	107
PID 2056 wrote to memory of 3360	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	107
PID 2056 wrote to memory of 792	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	109
PID 2056 wrote to memory of 792	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	109
PID 2056 wrote to memory of 2360	2056	4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe	110

C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4af88ef4a6ceca1e24db838015deac2b_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1520
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1336
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        
        PID:4928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 828
        6⤵
        Program crash
        
        PID:3436
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:524
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:5116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4708
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4348
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4868
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4424
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2448
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:436
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4992
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:5100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:732
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:664
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:5080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4088
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:648
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:464
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:396
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2900
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:216
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1448
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3644
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5112
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:588
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:436
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:64
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4384
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4512
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:64
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:876
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:920
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2344
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:736
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2800
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2736
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:384
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3244
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2628
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:528
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:64
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:3180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4780
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        11⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        11⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:632
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:3424
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:4136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:1432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4812
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3904
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3144
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:660
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:792
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3464
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4284
  - - C:\Windows\InstallDir\Server.exe
      "C:\Windows\InstallDir\Server.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:1692
    - - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1000
      - C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        7⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1336 -ip 1336
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Guwapi.umo

Filesize
394KB

MD5
01e195f30b535fe2c6bd19a958809799

SHA1
c0fe3f2d18b630caac7760f1aa48eb1bcce1825f

SHA256
54e3e33bdebf947b15503bb74ab87fcc2b25a5a2d88c287bc35960fdb102b48a

SHA512
c55585f1ca6e42c71f834645f988acbe39d15f7a75f083c5c0f4ae1ba3b19e4be483707b18db36ceb51b30c15412d7e6a3f7a74ed7092b083060da0ffad21466

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nusupumewu.dll

Filesize
11KB

MD5
a5be4fbb8fe08060c779ee7f206f7e40

SHA1
0d7cd2613abce8133b2f0e6e88cdca345ce7afaa

SHA256
c01b3508abdfdb58dae16e0de08792a0bb26be7f16d5be9abcbdd3f7fb573810

SHA512
2db534046d3acb226813dc346923e2ae5eb666f3ce5686a7fb66a893e521bd2d17b6fc2c3c7c09fed351cfe535d441d9d85c44ea3ea154e9de83dc50caca42ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Penamogodiy.dll

Filesize
3KB

MD5
327d5dabafb66291d1203a94a63ef331

SHA1
d691cb16ec44deafdf02954f3421d2dd24f3f6a7

SHA256
43f8f8e793c3db3cc526872c8fa847850757e14034b7749da0dfc69589ab176c

SHA512
4935a6fa8f8a6efe02879c7285ae8bb111f6f937d83c46f77add46ee77686be13e5e28d9f662db7843e45a47787a728a558edd33e808718e5e2e17e4b769ecfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zomafoyi.dll

Filesize
3KB

MD5
ec2842e7e52ccfe32c3e9a18120b197e

SHA1
7106a5ba84c41d270948eb7d820322346c55e91b

SHA256
cfefaef13e409dc106c18947038fde35616b72ba5d7f63a09665e1ece1aa49be

SHA512
15999656ce30451d3e4fff18062a96aa84b13b68434f7af0fcf3e6fd04971906a85cb144bf2e2a6f7bfb907fd81fd7bf252f0f3823c5b9ef6bf60be6890d873e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso7679.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4ZKhD25M\4ZKhD25M.dat

Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4ZKhD25M\4ZKhD25M.nfo

Filesize
3KB

MD5
4adbc3c8649c774a28c9a2ddcbef5650

SHA1
a085559a45ca7f7de2a55a9d895b7ec57fc8d3c1

SHA256
dd673c84b04cda3df515d3756a52e1b05b57e3e8f56dc442e337f6acccded752

SHA512
7cb75aaf8949f00bbcd20caed0d8532a9c981929029774f86f190a8a1df05d6002cc57ce8442a34728ce11c8f7757a585792d9fa46644c8297fa616878c41d57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\4ZKhD25M\4ZKhD25M.svr

Filesize
346KB

MD5
d66a2c0bab8c432e8db0e0ec5ea7cdd7

SHA1
beae77cb01b5c20095571a848461594d1b8ffb33

SHA256
c3aad752da5499aa3efc4725bda75e3cb5d33ac00ffbd4cfa99fa2a9d2fbf1ab

SHA512
71f22d8e23eda765af102bd2be1d50f630abc06cf494fa03d19276cf8110d5272f5296604395d5a5e8e12009f512df2a66c59581baf813c48b579cbe84446eeb

Download Submit
C:\Windows\InstallDir\Server.exe

Filesize
457KB

MD5
4af88ef4a6ceca1e24db838015deac2b

SHA1
b0a62cf9928e8d6a424b4d2c962feb127ae0ab5a

SHA256
3b502edbf977c5a629a89dca66683d9f3c79588b47dcf4177fc492fe01187c43

SHA512
8ea3197dc05832b8be3de4b4900af76d989bbbc7645f81966fecfafba3d6acddd79b649037c7169ba4f702d0fdb14d7ec6cd5c460e3b6c5e70dabf64bbe39d3b

Download Submit
memory/1156-118-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1520-53-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1520-55-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-44-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-48-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-46-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-58-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-63-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2056-49-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2396-31-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/2632-124-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-138-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-139-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-126-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-125-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-128-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-129-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-130-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-131-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-133-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-135-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2632-134-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/2956-216-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2956-219-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4148-32-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4148-37-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4148-38-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4868-256-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4868-257-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4868-255-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4868-259-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4868-258-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download