Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe
-
Size
243KB
-
MD5
dc0b1b3f27ad7d84bbc3e05f9481109a
-
SHA1
c0325f71da42b15a9ff8fb6dfc3183b1d195d3de
-
SHA256
aec91840021bf048d278bbc98c2d6538a48c93f9b16cac0339be326783e8f2bc
-
SHA512
7baaf946ae8565726b16289eb5bc3753cb18bddb1fa7e72f026e3b663290ea6e8915bbef7d0e4f329dc465727595aeffeafe9e28c1523720f7a62eec519291d5
-
SSDEEP
3072:S3b/eHVkDXy7HPaLGEqDNw7/tPYSRwjVxKx9YLRd3o5/mSB9oySEpin4DO87+DLH:SiHVkDXiaLlGQ1RUVtLn3E1B9lS4HyzL
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 60 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation wcoredg.exe -
Deletes itself 1 IoCs
pid Process 4220 wcoredg.exe -
Executes dropped EXE 64 IoCs
pid Process 3136 wcoredg.exe 4220 wcoredg.exe 3260 wcoredg.exe 324 wcoredg.exe 448 wcoredg.exe 1924 wcoredg.exe 3752 wcoredg.exe 3504 wcoredg.exe 4520 wcoredg.exe 3632 wcoredg.exe 3852 wcoredg.exe 2324 wcoredg.exe 1652 wcoredg.exe 3080 wcoredg.exe 4460 wcoredg.exe 4816 wcoredg.exe 4984 wcoredg.exe 1328 wcoredg.exe 2844 wcoredg.exe 4964 wcoredg.exe 4840 wcoredg.exe 1396 wcoredg.exe 996 wcoredg.exe 784 wcoredg.exe 4252 wcoredg.exe 2028 wcoredg.exe 1584 wcoredg.exe 3332 wcoredg.exe 4652 wcoredg.exe 2148 wcoredg.exe 1512 wcoredg.exe 4880 wcoredg.exe 1496 wcoredg.exe 3420 wcoredg.exe 4092 wcoredg.exe 2316 wcoredg.exe 4432 wcoredg.exe 2412 wcoredg.exe 4444 wcoredg.exe 4308 wcoredg.exe 2408 wcoredg.exe 2396 wcoredg.exe 3484 wcoredg.exe 1332 wcoredg.exe 728 wcoredg.exe 5028 wcoredg.exe 4476 wcoredg.exe 2672 wcoredg.exe 4708 wcoredg.exe 3296 wcoredg.exe 3616 wcoredg.exe 2740 wcoredg.exe 3892 wcoredg.exe 4252 wcoredg.exe 396 wcoredg.exe 1212 wcoredg.exe 4560 wcoredg.exe 4240 wcoredg.exe 4312 wcoredg.exe 2092 wcoredg.exe 2356 wcoredg.exe 3512 wcoredg.exe 3868 wcoredg.exe 1088 wcoredg.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File opened for modification C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe File created C:\Windows\SysWOW64\wcoredg.exe wcoredg.exe -
Suspicious use of SetThreadContext 61 IoCs
description pid Process procid_target PID 392 set thread context of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 3136 set thread context of 4220 3136 wcoredg.exe 85 PID 3260 set thread context of 324 3260 wcoredg.exe 87 PID 448 set thread context of 1924 448 wcoredg.exe 89 PID 3752 set thread context of 3504 3752 wcoredg.exe 91 PID 4520 set thread context of 3632 4520 wcoredg.exe 98 PID 3852 set thread context of 2324 3852 wcoredg.exe 103 PID 1652 set thread context of 3080 1652 wcoredg.exe 105 PID 4460 set thread context of 4816 4460 wcoredg.exe 111 PID 4984 set thread context of 1328 4984 wcoredg.exe 113 PID 2844 set thread context of 4964 2844 wcoredg.exe 115 PID 4840 set thread context of 1396 4840 wcoredg.exe 117 PID 996 set thread context of 784 996 wcoredg.exe 119 PID 4252 set thread context of 2028 4252 wcoredg.exe 123 PID 1584 set thread context of 3332 1584 wcoredg.exe 126 PID 4652 set thread context of 2148 4652 wcoredg.exe 128 PID 1512 set thread context of 4880 1512 wcoredg.exe 130 PID 1496 set thread context of 3420 1496 wcoredg.exe 132 PID 4092 set thread context of 2316 4092 wcoredg.exe 134 PID 4432 set thread context of 2412 4432 wcoredg.exe 136 PID 4444 set thread context of 4308 4444 wcoredg.exe 138 PID 2408 set thread context of 2396 2408 wcoredg.exe 140 PID 3484 set thread context of 1332 3484 wcoredg.exe 142 PID 728 set thread context of 5028 728 wcoredg.exe 144 PID 4476 set thread context of 2672 4476 wcoredg.exe 146 PID 4708 set thread context of 3296 4708 wcoredg.exe 149 PID 3616 set thread context of 2740 3616 wcoredg.exe 151 PID 3892 set thread context of 4252 3892 wcoredg.exe 153 PID 396 set thread context of 1212 396 wcoredg.exe 155 PID 4560 set thread context of 4240 4560 wcoredg.exe 157 PID 4312 set thread context of 2092 4312 wcoredg.exe 159 PID 2356 set thread context of 3512 2356 wcoredg.exe 161 PID 3868 set thread context of 1088 3868 wcoredg.exe 163 PID 3416 set thread context of 4400 3416 wcoredg.exe 165 PID 512 set thread context of 1140 512 wcoredg.exe 167 PID 1324 set thread context of 1736 1324 wcoredg.exe 169 PID 3684 set thread context of 4712 3684 wcoredg.exe 171 PID 2912 set thread context of 2780 2912 wcoredg.exe 173 PID 1004 set thread context of 1072 1004 wcoredg.exe 175 PID 1296 set thread context of 4512 1296 wcoredg.exe 177 PID 4952 set thread context of 1740 4952 wcoredg.exe 179 PID 4708 set thread context of 2384 4708 wcoredg.exe 181 PID 4408 set thread context of 516 4408 wcoredg.exe 183 PID 2428 set thread context of 3572 2428 wcoredg.exe 185 PID 3384 set thread context of 4284 3384 wcoredg.exe 187 PID 1212 set thread context of 3508 1212 wcoredg.exe 189 PID 4156 set thread context of 1872 4156 wcoredg.exe 191 PID 1464 set thread context of 2620 1464 wcoredg.exe 193 PID 1728 set thread context of 4872 1728 wcoredg.exe 195 PID 4148 set thread context of 4060 4148 wcoredg.exe 197 PID 944 set thread context of 2228 944 wcoredg.exe 199 PID 4584 set thread context of 3928 4584 wcoredg.exe 201 PID 4484 set thread context of 4500 4484 wcoredg.exe 203 PID 2216 set thread context of 1392 2216 wcoredg.exe 205 PID 2704 set thread context of 3712 2704 wcoredg.exe 207 PID 1228 set thread context of 2884 1228 wcoredg.exe 209 PID 5060 set thread context of 2340 5060 wcoredg.exe 211 PID 3476 set thread context of 2892 3476 wcoredg.exe 213 PID 4836 set thread context of 1920 4836 wcoredg.exe 215 PID 2992 set thread context of 1248 2992 wcoredg.exe 217 PID 2172 set thread context of 3444 2172 wcoredg.exe 219 -
resource yara_rule behavioral2/memory/3292-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3292-2-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3292-3-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3292-4-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3292-40-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4220-44-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4220-45-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4220-46-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4220-48-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/324-55-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1924-61-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3504-69-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3632-76-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2324-83-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3080-90-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4816-96-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1328-104-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4964-111-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1396-117-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/784-128-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2028-136-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3332-140-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3332-145-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2148-153-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4880-161-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3420-169-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2316-177-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2412-185-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4308-193-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2396-201-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1332-208-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/5028-214-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2672-220-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3296-226-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2740-232-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4252-238-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1212-244-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4240-250-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2092-256-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3512-262-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1088-268-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4400-274-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1140-280-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1736-286-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4712-292-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2780-298-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1072-304-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4512-310-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1740-316-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2384-322-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/516-328-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3572-334-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4284-340-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3508-346-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1872-352-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2620-358-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4872-364-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4060-370-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2228-376-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3928-382-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4500-388-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1392-394-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3712-400-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2884-406-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcoredg.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wcoredg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 3292 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 4220 wcoredg.exe 4220 wcoredg.exe 324 wcoredg.exe 324 wcoredg.exe 1924 wcoredg.exe 1924 wcoredg.exe 3504 wcoredg.exe 3504 wcoredg.exe 3632 wcoredg.exe 3632 wcoredg.exe 2324 wcoredg.exe 2324 wcoredg.exe 3080 wcoredg.exe 3080 wcoredg.exe 4816 wcoredg.exe 4816 wcoredg.exe 1328 wcoredg.exe 1328 wcoredg.exe 4964 wcoredg.exe 4964 wcoredg.exe 1396 wcoredg.exe 1396 wcoredg.exe 784 wcoredg.exe 784 wcoredg.exe 2028 wcoredg.exe 2028 wcoredg.exe 3332 wcoredg.exe 3332 wcoredg.exe 2148 wcoredg.exe 2148 wcoredg.exe 4880 wcoredg.exe 4880 wcoredg.exe 3420 wcoredg.exe 3420 wcoredg.exe 2316 wcoredg.exe 2316 wcoredg.exe 2412 wcoredg.exe 2412 wcoredg.exe 4308 wcoredg.exe 4308 wcoredg.exe 2396 wcoredg.exe 2396 wcoredg.exe 1332 wcoredg.exe 1332 wcoredg.exe 5028 wcoredg.exe 5028 wcoredg.exe 2672 wcoredg.exe 2672 wcoredg.exe 3296 wcoredg.exe 3296 wcoredg.exe 2740 wcoredg.exe 2740 wcoredg.exe 4252 wcoredg.exe 4252 wcoredg.exe 1212 wcoredg.exe 1212 wcoredg.exe 4240 wcoredg.exe 4240 wcoredg.exe 2092 wcoredg.exe 2092 wcoredg.exe 3512 wcoredg.exe 3512 wcoredg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 392 wrote to memory of 3292 392 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 83 PID 3292 wrote to memory of 3136 3292 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 84 PID 3292 wrote to memory of 3136 3292 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 84 PID 3292 wrote to memory of 3136 3292 dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe 84 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 3136 wrote to memory of 4220 3136 wcoredg.exe 85 PID 4220 wrote to memory of 3260 4220 wcoredg.exe 86 PID 4220 wrote to memory of 3260 4220 wcoredg.exe 86 PID 4220 wrote to memory of 3260 4220 wcoredg.exe 86 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 3260 wrote to memory of 324 3260 wcoredg.exe 87 PID 324 wrote to memory of 448 324 wcoredg.exe 88 PID 324 wrote to memory of 448 324 wcoredg.exe 88 PID 324 wrote to memory of 448 324 wcoredg.exe 88 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 448 wrote to memory of 1924 448 wcoredg.exe 89 PID 1924 wrote to memory of 3752 1924 wcoredg.exe 90 PID 1924 wrote to memory of 3752 1924 wcoredg.exe 90 PID 1924 wrote to memory of 3752 1924 wcoredg.exe 90 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3752 wrote to memory of 3504 3752 wcoredg.exe 91 PID 3504 wrote to memory of 4520 3504 wcoredg.exe 97 PID 3504 wrote to memory of 4520 3504 wcoredg.exe 97 PID 3504 wrote to memory of 4520 3504 wcoredg.exe 97 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 4520 wrote to memory of 3632 4520 wcoredg.exe 98 PID 3632 wrote to memory of 3852 3632 wcoredg.exe 100 PID 3632 wrote to memory of 3852 3632 wcoredg.exe 100 PID 3632 wrote to memory of 3852 3632 wcoredg.exe 100 PID 3852 wrote to memory of 2324 3852 wcoredg.exe 103 PID 3852 wrote to memory of 2324 3852 wcoredg.exe 103 PID 3852 wrote to memory of 2324 3852 wcoredg.exe 103 PID 3852 wrote to memory of 2324 3852 wcoredg.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc0b1b3f27ad7d84bbc3e05f9481109a_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Users\Admin\AppData\Local\Temp\DC0B1B~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Users\Admin\AppData\Local\Temp\DC0B1B~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2324 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1652 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3080 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4460 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4816 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4984 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1328 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2844 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4964 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4840 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:996 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:784 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1584 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3332 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4652 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2148 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4880 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1496 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3420 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4092 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2316 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2412 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4444 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4308 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2408 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3484 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:728 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4708 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3296 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2740 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4252 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1212 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4560 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4240 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4312 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2356 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3512 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3868 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1088 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe67⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe68⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4400 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:512 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1140 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe71⤵
- Suspicious use of SetThreadContext
PID:1324 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe72⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1736 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe73⤵
- Suspicious use of SetThreadContext
PID:3684 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe74⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4712 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe75⤵
- Suspicious use of SetThreadContext
PID:2912 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe76⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2780 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe77⤵
- Suspicious use of SetThreadContext
PID:1004 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe78⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1072 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe79⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4512 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe81⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4952 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe82⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1740 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe83⤵
- Suspicious use of SetThreadContext
PID:4708 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe84⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2384 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe85⤵
- Suspicious use of SetThreadContext
PID:4408 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe86⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:516 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe87⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe88⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3572 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe89⤵
- Suspicious use of SetThreadContext
PID:3384 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe90⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4284 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe91⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe92⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3508 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe94⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1872 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe95⤵
- Suspicious use of SetThreadContext
PID:1464 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe96⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2620 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe97⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe98⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4872 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe99⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe100⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4060 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe102⤵
- Checks computer location settings
- Modifies registry class
PID:2228 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe103⤵
- Suspicious use of SetThreadContext
PID:4584 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe104⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3928 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe105⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe106⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4500 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe107⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe108⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1392 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe109⤵
- Suspicious use of SetThreadContext
PID:2704 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe110⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3712 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe111⤵
- Suspicious use of SetThreadContext
PID:1228 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe112⤵
- Checks computer location settings
- Modifies registry class
PID:2884 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe113⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5060 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe114⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2340 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe115⤵
- Suspicious use of SetThreadContext
PID:3476 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe116⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2892 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe117⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe118⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe119⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\SysWOW64\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe120⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1248 -
C:\Windows\SysWOW64\wcoredg.exe"C:\Windows\system32\wcoredg.exe" C:\Windows\SysWOW64\wcoredg.exe121⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-