Analysis
-
max time kernel
74s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 04:56
Behavioral task
behavioral1
Sample
dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe
-
Size
848KB
-
MD5
dd1a45c15e24e374b1ce61322b1b038a
-
SHA1
83e881353184e940b2f8998cbb4fd3b029e5daa6
-
SHA256
5229fb1862d1f09f614df4ff096f36543e7dab2b533ae8f562e26cfce9ee0855
-
SHA512
08d69311860e2a73e9c3286515c1ad6388c603a8a4aa5be8b7f0c4f830156af93fe538833a19ee36bcbec7d4c801ae54c458dfaf760fe1b636d8193e3e893d94
-
SSDEEP
12288:oLn8V3EGAJi/jtNri+lckfi+B93Fp14KODz7coEpZocuRrp7hUkjJNNEuijUDlrB:oA30gtM4c4flODz7cQ5jfWui2Ut
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 33 IoCs
resource yara_rule behavioral1/memory/2944-32-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2760-40-0x0000000005B20000-0x0000000005C92000-memory.dmp modiloader_stage2 behavioral1/memory/2760-47-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/872-67-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2024-81-0x0000000005AB0000-0x0000000005C22000-memory.dmp modiloader_stage2 behavioral1/memory/2024-87-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2088-113-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2088-104-0x0000000004300000-0x0000000004472000-memory.dmp modiloader_stage2 behavioral1/memory/2636-120-0x0000000004240000-0x00000000043B2000-memory.dmp modiloader_stage2 behavioral1/memory/2636-126-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2168-144-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2664-169-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1976-189-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1796-202-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1796-196-0x00000000042A0000-0x0000000004412000-memory.dmp modiloader_stage2 behavioral1/memory/1036-220-0x0000000005BD0000-0x0000000005D42000-memory.dmp modiloader_stage2 behavioral1/memory/1036-221-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1804-239-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2848-257-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2728-272-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/576-285-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2152-303-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2568-313-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2560-326-0x0000000005CE0000-0x0000000005E52000-memory.dmp modiloader_stage2 behavioral1/memory/2560-332-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2788-342-0x00000000046B0000-0x0000000004822000-memory.dmp modiloader_stage2 behavioral1/memory/2788-344-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/2192-363-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1040-373-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1972-383-0x0000000005A20000-0x0000000005B92000-memory.dmp modiloader_stage2 behavioral1/memory/1972-395-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 behavioral1/memory/1600-401-0x00000000046E0000-0x0000000004852000-memory.dmp modiloader_stage2 behavioral1/memory/1600-406-0x0000000000400000-0x0000000000572000-memory.dmp modiloader_stage2 -
Checks BIOS information in registry 2 TTPs 64 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate vssms32.exe -
Executes dropped EXE 64 IoCs
pid Process 2760 vssms32.exe 872 vssms32.exe 2024 vssms32.exe 2088 vssms32.exe 2636 vssms32.exe 2168 vssms32.exe 2664 vssms32.exe 1976 vssms32.exe 1796 vssms32.exe 1036 vssms32.exe 1804 vssms32.exe 2848 vssms32.exe 2728 vssms32.exe 576 vssms32.exe 2152 vssms32.exe 2568 vssms32.exe 2560 vssms32.exe 2788 vssms32.exe 2192 vssms32.exe 1040 vssms32.exe 1972 vssms32.exe 1600 vssms32.exe 1028 vssms32.exe 2444 vssms32.exe 892 vssms32.exe 2604 vssms32.exe 2572 vssms32.exe 2552 vssms32.exe 2080 vssms32.exe 3056 vssms32.exe 2304 vssms32.exe 2976 vssms32.exe 2296 vssms32.exe 2212 vssms32.exe 628 vssms32.exe 1080 vssms32.exe 2284 vssms32.exe 2540 vssms32.exe 1028 vssms32.exe 2064 vssms32.exe 2700 vssms32.exe 2704 vssms32.exe 796 vssms32.exe 2404 vssms32.exe 2676 vssms32.exe 2908 vssms32.exe 2420 vssms32.exe 2268 vssms32.exe 2276 vssms32.exe 2432 vssms32.exe 2668 vssms32.exe 956 vssms32.exe 1664 vssms32.exe 2616 vssms32.exe 2324 vssms32.exe 2864 vssms32.exe 3068 vssms32.exe 2084 vssms32.exe 776 vssms32.exe 1552 vssms32.exe 2912 vssms32.exe 2932 vssms32.exe 2204 vssms32.exe 2268 vssms32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe -
Loads dropped DLL 64 IoCs
pid Process 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 2760 vssms32.exe 2760 vssms32.exe 872 vssms32.exe 872 vssms32.exe 2024 vssms32.exe 2024 vssms32.exe 2088 vssms32.exe 2088 vssms32.exe 2636 vssms32.exe 2636 vssms32.exe 2168 vssms32.exe 2168 vssms32.exe 2664 vssms32.exe 2664 vssms32.exe 1976 vssms32.exe 1976 vssms32.exe 1796 vssms32.exe 1796 vssms32.exe 1036 vssms32.exe 1036 vssms32.exe 1804 vssms32.exe 1804 vssms32.exe 2848 vssms32.exe 2848 vssms32.exe 2728 vssms32.exe 2728 vssms32.exe 576 vssms32.exe 576 vssms32.exe 2152 vssms32.exe 2152 vssms32.exe 2568 vssms32.exe 2568 vssms32.exe 2560 vssms32.exe 2560 vssms32.exe 2788 vssms32.exe 2788 vssms32.exe 2192 vssms32.exe 2192 vssms32.exe 1040 vssms32.exe 1040 vssms32.exe 1972 vssms32.exe 1972 vssms32.exe 1600 vssms32.exe 1600 vssms32.exe 1028 vssms32.exe 1028 vssms32.exe 2444 vssms32.exe 2444 vssms32.exe 892 vssms32.exe 892 vssms32.exe 2604 vssms32.exe 2604 vssms32.exe 2572 vssms32.exe 2572 vssms32.exe 2552 vssms32.exe 2552 vssms32.exe 2080 vssms32.exe 2080 vssms32.exe 3056 vssms32.exe 3056 vssms32.exe 2304 vssms32.exe 2304 vssms32.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vssms32 = "C:\\Windows\\system32\\vssms32.exe" vssms32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe File opened for modification C:\Windows\SysWOW64\vssms32.exe vssms32.exe File created C:\Windows\SysWOW64\vssms32.exe vssms32.exe -
resource yara_rule behavioral1/memory/2944-0-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/files/0x0033000000018650-14.dat upx behavioral1/memory/2944-20-0x0000000004530000-0x00000000046A2000-memory.dmp upx behavioral1/memory/2760-24-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2944-32-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/872-67-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2024-87-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2088-113-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2636-105-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2636-126-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2168-144-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2664-169-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1976-189-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1796-181-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1796-202-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1036-220-0x0000000005BD0000-0x0000000005D42000-memory.dmp upx behavioral1/memory/1036-221-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1804-239-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2848-257-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2728-272-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/576-285-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2152-303-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2568-313-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2788-322-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2560-326-0x0000000005CE0000-0x0000000005E52000-memory.dmp upx behavioral1/memory/2560-332-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2788-344-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/2192-363-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1040-373-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1972-374-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1600-385-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1972-395-0x0000000000400000-0x0000000000572000-memory.dmp upx behavioral1/memory/1600-406-0x0000000000400000-0x0000000000572000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssms32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "IgAXB~BXtsUYpOpyZ@KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "GwAXB~BXzcUYpOpyZpKUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VYTOZny]UwpAa@" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V[tOZny]U{}KM`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VSXNZny]`dqYy`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VVhNZny]@GDHT@" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "XGAXB~BXeSUYpOpyZ`KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VRtOZny]McYRXP" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\eHsxayfzkTYku = "lMicWmzabbbO@wpe\\ogp^nHeryF" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V[`OZny]SWV\x7fp`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VTtNZny]^SACd@" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\eHsxayfzkTYku = "lMicWmzabbbO@wpe\\ogp^nHeryF" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VYLOZny]HpMi\\p" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VYpOZny]|iPy|P" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "]GAXB~BX`SUYpOpyZ`KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "YGAXB~BXdSUYpOpyZ`KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\eHsxayfzkTYku = "lMicWmzabbbO@wpe\\ogp^nHeryF" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V_LOZny]lx\\WAp" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VThMZny]jOwYYp" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\eHsxayfzkTYku = "lMicWmzabbbO@wpe\\ogp^nHeryF" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VUHNZny]`bVb``" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VU|NZny]VZPfQ`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VPDNZny]kQCZO`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V_xNZny]Jho~wp" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "IwAXB~BXtcUYpOpyZ@KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V[hNZny]nxUGG@" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\BdyclNfQXJt = "sBFyMecKyJZ`FlEILL|lb@N_wcv@K]GK" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VV@NZny]Xsg}u`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "]gAXB~BX`sUYpOpyZ`KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V\\PNZny]BmsQnp" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "SgAXB~BXnsUYpOpyZ`KUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\ooerHlPjgh = "DgAXB~BXysUYpOpyZpKUfWaZbD[CMswu" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\lVckucLdnLh = "Uh_z\\\x7fFtyi|CTUzV" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V_hOZny]cPtKs`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "VYxOZny]~HKmmp" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\eHsxayfzkTYku = "lMicWmzabbbO@wpe\\ogp^nHeryF" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\bpNsiWeint = "V\\@NZny]hC}E\\`" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\JomNNdfCoC = "AudODzmPbWT{JdOkcD{vBVM]zWfoi" vssms32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3571969E-C383-C239-1526-065215260652}\icdtwnz = "nNnvjYEkBRca\x7f`ixyRD}" vssms32.exe -
NTFS ADS 64 IoCs
description ioc Process File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File created C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe File opened for modification C:\ProgramData\TEMP:CE2C623F vssms32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe Token: 33 2760 vssms32.exe Token: SeIncBasePriorityPrivilege 2760 vssms32.exe Token: 33 872 vssms32.exe Token: SeIncBasePriorityPrivilege 872 vssms32.exe Token: 33 2024 vssms32.exe Token: SeIncBasePriorityPrivilege 2024 vssms32.exe Token: 33 2088 vssms32.exe Token: SeIncBasePriorityPrivilege 2088 vssms32.exe Token: 33 2636 vssms32.exe Token: SeIncBasePriorityPrivilege 2636 vssms32.exe Token: 33 2168 vssms32.exe Token: SeIncBasePriorityPrivilege 2168 vssms32.exe Token: 33 2664 vssms32.exe Token: SeIncBasePriorityPrivilege 2664 vssms32.exe Token: 33 1976 vssms32.exe Token: SeIncBasePriorityPrivilege 1976 vssms32.exe Token: 33 1796 vssms32.exe Token: SeIncBasePriorityPrivilege 1796 vssms32.exe Token: 33 1036 vssms32.exe Token: SeIncBasePriorityPrivilege 1036 vssms32.exe Token: 33 1804 vssms32.exe Token: SeIncBasePriorityPrivilege 1804 vssms32.exe Token: 33 2848 vssms32.exe Token: SeIncBasePriorityPrivilege 2848 vssms32.exe Token: 33 2728 vssms32.exe Token: SeIncBasePriorityPrivilege 2728 vssms32.exe Token: 33 576 vssms32.exe Token: SeIncBasePriorityPrivilege 576 vssms32.exe Token: 33 2152 vssms32.exe Token: SeIncBasePriorityPrivilege 2152 vssms32.exe Token: 33 2568 vssms32.exe Token: SeIncBasePriorityPrivilege 2568 vssms32.exe Token: 33 2560 vssms32.exe Token: SeIncBasePriorityPrivilege 2560 vssms32.exe Token: 33 2788 vssms32.exe Token: SeIncBasePriorityPrivilege 2788 vssms32.exe Token: 33 2192 vssms32.exe Token: SeIncBasePriorityPrivilege 2192 vssms32.exe Token: 33 1040 vssms32.exe Token: SeIncBasePriorityPrivilege 1040 vssms32.exe Token: 33 1972 vssms32.exe Token: SeIncBasePriorityPrivilege 1972 vssms32.exe Token: 33 1600 vssms32.exe Token: SeIncBasePriorityPrivilege 1600 vssms32.exe Token: 33 1028 vssms32.exe Token: SeIncBasePriorityPrivilege 1028 vssms32.exe Token: 33 2444 vssms32.exe Token: SeIncBasePriorityPrivilege 2444 vssms32.exe Token: 33 892 vssms32.exe Token: SeIncBasePriorityPrivilege 892 vssms32.exe Token: 33 2604 vssms32.exe Token: SeIncBasePriorityPrivilege 2604 vssms32.exe Token: 33 2572 vssms32.exe Token: SeIncBasePriorityPrivilege 2572 vssms32.exe Token: 33 2552 vssms32.exe Token: SeIncBasePriorityPrivilege 2552 vssms32.exe Token: 33 2080 vssms32.exe Token: SeIncBasePriorityPrivilege 2080 vssms32.exe Token: 33 3056 vssms32.exe Token: SeIncBasePriorityPrivilege 3056 vssms32.exe Token: 33 2304 vssms32.exe Token: SeIncBasePriorityPrivilege 2304 vssms32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2760 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 30 PID 2944 wrote to memory of 2760 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 30 PID 2944 wrote to memory of 2760 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 30 PID 2944 wrote to memory of 2760 2944 dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe 30 PID 2760 wrote to memory of 872 2760 vssms32.exe 31 PID 2760 wrote to memory of 872 2760 vssms32.exe 31 PID 2760 wrote to memory of 872 2760 vssms32.exe 31 PID 2760 wrote to memory of 872 2760 vssms32.exe 31 PID 872 wrote to memory of 2024 872 vssms32.exe 32 PID 872 wrote to memory of 2024 872 vssms32.exe 32 PID 872 wrote to memory of 2024 872 vssms32.exe 32 PID 872 wrote to memory of 2024 872 vssms32.exe 32 PID 2024 wrote to memory of 2088 2024 vssms32.exe 33 PID 2024 wrote to memory of 2088 2024 vssms32.exe 33 PID 2024 wrote to memory of 2088 2024 vssms32.exe 33 PID 2024 wrote to memory of 2088 2024 vssms32.exe 33 PID 2088 wrote to memory of 2636 2088 vssms32.exe 34 PID 2088 wrote to memory of 2636 2088 vssms32.exe 34 PID 2088 wrote to memory of 2636 2088 vssms32.exe 34 PID 2088 wrote to memory of 2636 2088 vssms32.exe 34 PID 2636 wrote to memory of 2168 2636 vssms32.exe 35 PID 2636 wrote to memory of 2168 2636 vssms32.exe 35 PID 2636 wrote to memory of 2168 2636 vssms32.exe 35 PID 2636 wrote to memory of 2168 2636 vssms32.exe 35 PID 2168 wrote to memory of 2664 2168 vssms32.exe 36 PID 2168 wrote to memory of 2664 2168 vssms32.exe 36 PID 2168 wrote to memory of 2664 2168 vssms32.exe 36 PID 2168 wrote to memory of 2664 2168 vssms32.exe 36 PID 2664 wrote to memory of 1976 2664 vssms32.exe 37 PID 2664 wrote to memory of 1976 2664 vssms32.exe 37 PID 2664 wrote to memory of 1976 2664 vssms32.exe 37 PID 2664 wrote to memory of 1976 2664 vssms32.exe 37 PID 1976 wrote to memory of 1796 1976 vssms32.exe 38 PID 1976 wrote to memory of 1796 1976 vssms32.exe 38 PID 1976 wrote to memory of 1796 1976 vssms32.exe 38 PID 1976 wrote to memory of 1796 1976 vssms32.exe 38 PID 1796 wrote to memory of 1036 1796 vssms32.exe 39 PID 1796 wrote to memory of 1036 1796 vssms32.exe 39 PID 1796 wrote to memory of 1036 1796 vssms32.exe 39 PID 1796 wrote to memory of 1036 1796 vssms32.exe 39 PID 1036 wrote to memory of 1804 1036 vssms32.exe 40 PID 1036 wrote to memory of 1804 1036 vssms32.exe 40 PID 1036 wrote to memory of 1804 1036 vssms32.exe 40 PID 1036 wrote to memory of 1804 1036 vssms32.exe 40 PID 1804 wrote to memory of 2848 1804 vssms32.exe 41 PID 1804 wrote to memory of 2848 1804 vssms32.exe 41 PID 1804 wrote to memory of 2848 1804 vssms32.exe 41 PID 1804 wrote to memory of 2848 1804 vssms32.exe 41 PID 2848 wrote to memory of 2728 2848 vssms32.exe 42 PID 2848 wrote to memory of 2728 2848 vssms32.exe 42 PID 2848 wrote to memory of 2728 2848 vssms32.exe 42 PID 2848 wrote to memory of 2728 2848 vssms32.exe 42 PID 2728 wrote to memory of 576 2728 vssms32.exe 43 PID 2728 wrote to memory of 576 2728 vssms32.exe 43 PID 2728 wrote to memory of 576 2728 vssms32.exe 43 PID 2728 wrote to memory of 576 2728 vssms32.exe 43 PID 576 wrote to memory of 2152 576 vssms32.exe 44 PID 576 wrote to memory of 2152 576 vssms32.exe 44 PID 576 wrote to memory of 2152 576 vssms32.exe 44 PID 576 wrote to memory of 2152 576 vssms32.exe 44 PID 2152 wrote to memory of 2568 2152 vssms32.exe 45 PID 2152 wrote to memory of 2568 2152 vssms32.exe 45 PID 2152 wrote to memory of 2568 2152 vssms32.exe 45 PID 2152 wrote to memory of 2568 2152 vssms32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd1a45c15e24e374b1ce61322b1b038a_JaffaCakes118.exe"1⤵
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"10⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"11⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"12⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"14⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"15⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"17⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"20⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1040 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"22⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"23⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:1028 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"26⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:892 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"27⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"29⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"30⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"32⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"33⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"34⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"35⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2212 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"37⤵
- Checks BIOS information in registry
- Executes dropped EXE
- NTFS ADS
PID:1080 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"38⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"39⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2540 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"40⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1028 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"41⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- NTFS ADS
PID:2064 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"42⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2700 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"43⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- NTFS ADS
PID:2704 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"44⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:796 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"45⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2404 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"46⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:2676 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"47⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"48⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2420 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"49⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2268 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"51⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2432 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"52⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
PID:2668 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:956 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1664 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2616 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"56⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2324 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"57⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
PID:2864 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"58⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:3068 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"59⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2084 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"60⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
PID:776 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"61⤵
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"63⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2204 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"65⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2268 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"66⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:1732 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"67⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2652 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"68⤵
- Adds Run key to start application
- Modifies registry class
PID:1032 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"69⤵
- Drops file in System32 directory
PID:916 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"70⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2380 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"71⤵
- Modifies registry class
PID:2960 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"72⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1004 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"73⤵
- Checks BIOS information in registry
- Modifies registry class
PID:1092 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"74⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2760 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"75⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2412 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"76⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:3020 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"77⤵
- Checks BIOS information in registry
PID:3032 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"78⤵
- Adds Run key to start application
- Modifies registry class
PID:812 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"79⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"80⤵
- Adds Run key to start application
PID:2144 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"81⤵
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"82⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Modifies registry class
PID:1472 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"83⤵
- Checks BIOS information in registry
- Modifies registry class
- NTFS ADS
PID:1332 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"84⤵
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"85⤵PID:1796
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"86⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"87⤵
- Drops file in System32 directory
PID:2324 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"88⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:1084 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"89⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:764 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"90⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"91⤵
- Adds Run key to start application
- Modifies registry class
- NTFS ADS
PID:2424 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"92⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"93⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1768 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"94⤵
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"95⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"96⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
PID:2264 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"97⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Modifies registry class
- NTFS ADS
PID:984 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"98⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"99⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2292 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"100⤵
- System Location Discovery: System Language Discovery
PID:1536 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"101⤵
- Checks BIOS information in registry
- Modifies registry class
- NTFS ADS
PID:688 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"102⤵
- Adds Run key to start application
PID:2512 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"103⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"104⤵
- Adds Run key to start application
- Drops file in System32 directory
- NTFS ADS
PID:1004 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"105⤵
- Checks BIOS information in registry
- Adds Run key to start application
- NTFS ADS
PID:836 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"106⤵
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"107⤵
- Drops file in System32 directory
- Modifies registry class
PID:2424 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"108⤵PID:1988
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"109⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:812 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"110⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- NTFS ADS
PID:2136 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"111⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:952 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"112⤵
- Adds Run key to start application
- NTFS ADS
PID:372 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"113⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2484 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"114⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- NTFS ADS
PID:1660 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"115⤵
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
PID:1248 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"116⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"117⤵
- Checks BIOS information in registry
PID:2532 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"118⤵PID:2176
-
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"119⤵
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3068 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"120⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- NTFS ADS
PID:2336 -
C:\Windows\SysWOW64\vssms32.exe"C:\Windows\system32\vssms32.exe"121⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-