Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 04:19
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe
-
Size
267KB
-
MD5
0205ecc7bf826715488e834f07e8eb6c
-
SHA1
74f7f30baa9e4e2619f2f7c2f793e7dedc20ba0b
-
SHA256
b21f11dceea0da86071bc303babe191839fb79325fee5f76c9fe016bc1a12091
-
SHA512
d698313ad10fd7fa9c3dae0d9904239bef001131e53ebf9fad34135476dcce057347c6fcd492c4de5976da616c923becb5c6e2de2fcda94ddc4a4b3594d92ca3
-
SSDEEP
6144:8QU5I0zbulDodOk/IKNGkcJIoFZIEWOKsS9BY:8bIkbpIKsksrFr8ry
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 49 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wiacmfgr.exe -
Deletes itself 1 IoCs
pid Process 4520 wiacmfgr.exe -
Executes dropped EXE 64 IoCs
pid Process 4812 wiacmfgr.exe 4520 wiacmfgr.exe 3832 wiacmfgr.exe 60 wiacmfgr.exe 2928 wiacmfgr.exe 3400 wiacmfgr.exe 4692 wiacmfgr.exe 1204 wiacmfgr.exe 4864 wiacmfgr.exe 2588 wiacmfgr.exe 3132 wiacmfgr.exe 2268 wiacmfgr.exe 4804 wiacmfgr.exe 536 wiacmfgr.exe 4412 wiacmfgr.exe 4600 wiacmfgr.exe 1744 wiacmfgr.exe 2220 wiacmfgr.exe 4140 wiacmfgr.exe 3512 wiacmfgr.exe 552 wiacmfgr.exe 2604 wiacmfgr.exe 3160 wiacmfgr.exe 2848 wiacmfgr.exe 3964 wiacmfgr.exe 2856 wiacmfgr.exe 1180 wiacmfgr.exe 2036 wiacmfgr.exe 3236 wiacmfgr.exe 2424 wiacmfgr.exe 3156 wiacmfgr.exe 1792 wiacmfgr.exe 888 wiacmfgr.exe 4004 wiacmfgr.exe 4888 wiacmfgr.exe 2940 wiacmfgr.exe 4472 wiacmfgr.exe 3808 wiacmfgr.exe 1076 wiacmfgr.exe 1504 wiacmfgr.exe 1616 wiacmfgr.exe 2524 wiacmfgr.exe 4644 wiacmfgr.exe 1908 wiacmfgr.exe 1844 wiacmfgr.exe 244 wiacmfgr.exe 4136 wiacmfgr.exe 4876 wiacmfgr.exe 2460 wiacmfgr.exe 4028 wiacmfgr.exe 4120 wiacmfgr.exe 548 wiacmfgr.exe 1208 wiacmfgr.exe 3680 wiacmfgr.exe 264 wiacmfgr.exe 2216 wiacmfgr.exe 4904 wiacmfgr.exe 2856 wiacmfgr.exe 4892 wiacmfgr.exe 1140 wiacmfgr.exe 4124 wiacmfgr.exe 1468 wiacmfgr.exe 4448 wiacmfgr.exe 1792 wiacmfgr.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe -
Suspicious use of SetThreadContext 49 IoCs
description pid Process procid_target PID 208 set thread context of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 4812 set thread context of 4520 4812 wiacmfgr.exe 85 PID 3832 set thread context of 60 3832 wiacmfgr.exe 89 PID 2928 set thread context of 3400 2928 wiacmfgr.exe 95 PID 4692 set thread context of 1204 4692 wiacmfgr.exe 99 PID 4864 set thread context of 2588 4864 wiacmfgr.exe 105 PID 3132 set thread context of 2268 3132 wiacmfgr.exe 107 PID 4804 set thread context of 536 4804 wiacmfgr.exe 109 PID 4412 set thread context of 4600 4412 wiacmfgr.exe 111 PID 1744 set thread context of 2220 1744 wiacmfgr.exe 113 PID 4140 set thread context of 3512 4140 wiacmfgr.exe 118 PID 552 set thread context of 2604 552 wiacmfgr.exe 120 PID 3160 set thread context of 2848 3160 wiacmfgr.exe 122 PID 3964 set thread context of 2856 3964 wiacmfgr.exe 124 PID 1180 set thread context of 2036 1180 wiacmfgr.exe 126 PID 3236 set thread context of 2424 3236 wiacmfgr.exe 128 PID 3156 set thread context of 1792 3156 wiacmfgr.exe 130 PID 888 set thread context of 4004 888 wiacmfgr.exe 132 PID 4888 set thread context of 2940 4888 wiacmfgr.exe 134 PID 4472 set thread context of 3808 4472 wiacmfgr.exe 136 PID 1076 set thread context of 1504 1076 wiacmfgr.exe 138 PID 1616 set thread context of 2524 1616 wiacmfgr.exe 140 PID 4644 set thread context of 1908 4644 wiacmfgr.exe 142 PID 1844 set thread context of 244 1844 wiacmfgr.exe 144 PID 4136 set thread context of 4876 4136 wiacmfgr.exe 146 PID 2460 set thread context of 4028 2460 wiacmfgr.exe 148 PID 4120 set thread context of 548 4120 wiacmfgr.exe 150 PID 1208 set thread context of 3680 1208 wiacmfgr.exe 152 PID 264 set thread context of 2216 264 wiacmfgr.exe 154 PID 4904 set thread context of 2856 4904 wiacmfgr.exe 156 PID 4892 set thread context of 1140 4892 wiacmfgr.exe 158 PID 4124 set thread context of 1468 4124 wiacmfgr.exe 160 PID 4448 set thread context of 1792 4448 wiacmfgr.exe 162 PID 4100 set thread context of 3704 4100 wiacmfgr.exe 164 PID 3956 set thread context of 2912 3956 wiacmfgr.exe 166 PID 1880 set thread context of 2708 1880 wiacmfgr.exe 168 PID 3088 set thread context of 3984 3088 wiacmfgr.exe 170 PID 1748 set thread context of 2320 1748 wiacmfgr.exe 172 PID 3244 set thread context of 3060 3244 wiacmfgr.exe 174 PID 4564 set thread context of 2736 4564 wiacmfgr.exe 176 PID 1596 set thread context of 4860 1596 wiacmfgr.exe 178 PID 3232 set thread context of 4036 3232 wiacmfgr.exe 180 PID 4072 set thread context of 1840 4072 wiacmfgr.exe 182 PID 3120 set thread context of 1208 3120 wiacmfgr.exe 184 PID 1516 set thread context of 4596 1516 wiacmfgr.exe 186 PID 432 set thread context of 2236 432 wiacmfgr.exe 188 PID 2928 set thread context of 720 2928 wiacmfgr.exe 190 PID 3516 set thread context of 4616 3516 wiacmfgr.exe 192 PID 2012 set thread context of 4160 2012 wiacmfgr.exe 194 -
resource yara_rule behavioral2/memory/1708-2-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1708-0-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1708-4-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1708-3-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1708-38-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4520-43-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4520-45-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4520-44-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4520-47-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/60-52-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/60-51-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/60-55-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3400-61-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1204-71-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2588-76-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2588-78-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2268-85-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/536-92-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4600-99-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2220-106-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3512-112-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2604-121-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2848-130-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2856-138-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2036-146-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2424-154-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1792-162-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4004-170-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2940-178-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3808-187-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1504-195-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2524-203-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1908-211-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/244-217-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4876-223-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4028-229-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/548-235-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3680-241-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2216-247-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2856-253-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1140-259-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1468-265-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1792-271-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3704-277-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2912-283-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2708-289-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3984-295-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2320-301-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3060-307-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2736-313-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4860-319-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4036-325-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1840-331-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1208-337-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4596-343-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2236-349-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/720-355-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4616-361-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4160-367-0x0000000000400000-0x0000000000463000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe -
Modifies registry class 49 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wiacmfgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 1708 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 4520 wiacmfgr.exe 4520 wiacmfgr.exe 60 wiacmfgr.exe 60 wiacmfgr.exe 3400 wiacmfgr.exe 3400 wiacmfgr.exe 1204 wiacmfgr.exe 1204 wiacmfgr.exe 2588 wiacmfgr.exe 2588 wiacmfgr.exe 2268 wiacmfgr.exe 2268 wiacmfgr.exe 536 wiacmfgr.exe 536 wiacmfgr.exe 4600 wiacmfgr.exe 4600 wiacmfgr.exe 2220 wiacmfgr.exe 2220 wiacmfgr.exe 3512 wiacmfgr.exe 3512 wiacmfgr.exe 2604 wiacmfgr.exe 2604 wiacmfgr.exe 2848 wiacmfgr.exe 2848 wiacmfgr.exe 2856 wiacmfgr.exe 2856 wiacmfgr.exe 2036 wiacmfgr.exe 2036 wiacmfgr.exe 2424 wiacmfgr.exe 2424 wiacmfgr.exe 1792 wiacmfgr.exe 1792 wiacmfgr.exe 4004 wiacmfgr.exe 4004 wiacmfgr.exe 2940 wiacmfgr.exe 2940 wiacmfgr.exe 3808 wiacmfgr.exe 3808 wiacmfgr.exe 1504 wiacmfgr.exe 1504 wiacmfgr.exe 2524 wiacmfgr.exe 2524 wiacmfgr.exe 1908 wiacmfgr.exe 1908 wiacmfgr.exe 244 wiacmfgr.exe 244 wiacmfgr.exe 4876 wiacmfgr.exe 4876 wiacmfgr.exe 4028 wiacmfgr.exe 4028 wiacmfgr.exe 548 wiacmfgr.exe 548 wiacmfgr.exe 3680 wiacmfgr.exe 3680 wiacmfgr.exe 2216 wiacmfgr.exe 2216 wiacmfgr.exe 2856 wiacmfgr.exe 2856 wiacmfgr.exe 1140 wiacmfgr.exe 1140 wiacmfgr.exe 1468 wiacmfgr.exe 1468 wiacmfgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 208 wrote to memory of 1708 208 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 83 PID 1708 wrote to memory of 4812 1708 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 84 PID 1708 wrote to memory of 4812 1708 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 84 PID 1708 wrote to memory of 4812 1708 JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe 84 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4812 wrote to memory of 4520 4812 wiacmfgr.exe 85 PID 4520 wrote to memory of 3832 4520 wiacmfgr.exe 86 PID 4520 wrote to memory of 3832 4520 wiacmfgr.exe 86 PID 4520 wrote to memory of 3832 4520 wiacmfgr.exe 86 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 3832 wrote to memory of 60 3832 wiacmfgr.exe 89 PID 60 wrote to memory of 2928 60 wiacmfgr.exe 94 PID 60 wrote to memory of 2928 60 wiacmfgr.exe 94 PID 60 wrote to memory of 2928 60 wiacmfgr.exe 94 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 2928 wrote to memory of 3400 2928 wiacmfgr.exe 95 PID 3400 wrote to memory of 4692 3400 wiacmfgr.exe 98 PID 3400 wrote to memory of 4692 3400 wiacmfgr.exe 98 PID 3400 wrote to memory of 4692 3400 wiacmfgr.exe 98 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 4692 wrote to memory of 1204 4692 wiacmfgr.exe 99 PID 1204 wrote to memory of 4864 1204 wiacmfgr.exe 104 PID 1204 wrote to memory of 4864 1204 wiacmfgr.exe 104 PID 1204 wrote to memory of 4864 1204 wiacmfgr.exe 104 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 4864 wrote to memory of 2588 4864 wiacmfgr.exe 105 PID 2588 wrote to memory of 3132 2588 wiacmfgr.exe 106 PID 2588 wrote to memory of 3132 2588 wiacmfgr.exe 106 PID 2588 wrote to memory of 3132 2588 wiacmfgr.exe 106 PID 3132 wrote to memory of 2268 3132 wiacmfgr.exe 107 PID 3132 wrote to memory of 2268 3132 wiacmfgr.exe 107 PID 3132 wrote to memory of 2268 3132 wiacmfgr.exe 107 PID 3132 wrote to memory of 2268 3132 wiacmfgr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0205ecc7bf826715488e834f07e8eb6c.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2268 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4804 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:536 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4412 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4600 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2220 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3512 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:552 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3964 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2856 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2036 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3236 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3156 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1792 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:888 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4004 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3808 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1076 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1844 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:244 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4136 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4876 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2460 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4028 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4120 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:548 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1208 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3680 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:264 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2216 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2856 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1140 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4124 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1468 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4448 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1792 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe67⤵
- Suspicious use of SetThreadContext
PID:4100 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe68⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3704 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe69⤵
- Suspicious use of SetThreadContext
PID:3956 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe70⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2912 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe71⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe72⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2708 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe74⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3984 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe76⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2320 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe77⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe78⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe79⤵
- Suspicious use of SetThreadContext
PID:4564 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2736 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe81⤵
- Suspicious use of SetThreadContext
PID:1596 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe82⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4860 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe83⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe84⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4036 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe85⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe86⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1840 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe87⤵
- Suspicious use of SetThreadContext
PID:3120 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe88⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1208 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe89⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe90⤵
- Checks computer location settings
- Modifies registry class
PID:4596 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe91⤵
- Suspicious use of SetThreadContext
PID:432 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe92⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2236 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe94⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:720 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe95⤵
- Suspicious use of SetThreadContext
PID:3516 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe96⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4616 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe97⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\SysWOW64\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe98⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4160 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe99⤵PID:3392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD50205ecc7bf826715488e834f07e8eb6c
SHA174f7f30baa9e4e2619f2f7c2f793e7dedc20ba0b
SHA256b21f11dceea0da86071bc303babe191839fb79325fee5f76c9fe016bc1a12091
SHA512d698313ad10fd7fa9c3dae0d9904239bef001131e53ebf9fad34135476dcce057347c6fcd492c4de5976da616c923becb5c6e2de2fcda94ddc4a4b3594d92ca3