4400d1c3d34f7e4bf890acfbb58f0ae36b44c823f0dc3b7c479d044e8cc45515

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2025, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe
Size 1.4MB
Sample250226-flvm9azrx9
SHA256 4400d1c3d34f7e4bf890acfbb58f0ae36b44c823f0dc3b7c479d044e8cc45515
MD5 23d54773637b1eef3f14db2f9b2c43e6
SHA1 14fc087c99552b61ccaf5e759038cc50025d602f
SHA512 c58b337d40a3fec7e0c8458dad3cd7bc25cfdd4ba65a7baa8932be014f63405a77250e92e84ad98d3203e5eb1094e5f3d47e601ce27938082e3e71855a4abb3f
SSDEEP 24576:uRRJkcoQricOIQxiZY1PaMPFe9yp0flCKf87wKaHnCMjORymu7Xmg7FT2b5:sJZoQrbTFZY1PaMPU9yilCKk16zt2g7g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
5048	taskkill.exe
808	taskkill.exe
1084	taskkill.exe
5000	taskkill.exe
1448	taskkill.exe
2512	taskkill.exe
1180	taskkill.exe
2240	taskkill.exe
2904	taskkill.exe
5116	taskkill.exe
4184	taskkill.exe
4064	taskkill.exe
5048	taskkill.exe
2064	taskkill.exe
860	taskkill.exe
4364	taskkill.exe
3776	taskkill.exe
1964	taskkill.exe
4308	taskkill.exe
1748	taskkill.exe
868	taskkill.exe
3192	taskkill.exe
4172	taskkill.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	4308	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	1084	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	4364	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	868	taskkill.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2708	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	95
PID 2244 wrote to memory of 2708	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	95
PID 2244 wrote to memory of 2708	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	95
PID 2708 wrote to memory of 1964	2708	cmd.exe	97
PID 2708 wrote to memory of 1964	2708	cmd.exe	97
PID 2708 wrote to memory of 1964	2708	cmd.exe	97
PID 2244 wrote to memory of 1224	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	100
PID 2244 wrote to memory of 1224	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	100
PID 2244 wrote to memory of 1224	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	100
PID 1224 wrote to memory of 5116	1224	cmd.exe	102
PID 1224 wrote to memory of 5116	1224	cmd.exe	102
PID 1224 wrote to memory of 5116	1224	cmd.exe	102
PID 2244 wrote to memory of 776	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	104
PID 2244 wrote to memory of 776	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	104
PID 2244 wrote to memory of 776	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	104
PID 776 wrote to memory of 5048	776	cmd.exe	106
PID 776 wrote to memory of 5048	776	cmd.exe	106
PID 776 wrote to memory of 5048	776	cmd.exe	106
PID 2244 wrote to memory of 4288	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	107
PID 2244 wrote to memory of 4288	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	107
PID 2244 wrote to memory of 4288	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	107
PID 4288 wrote to memory of 4184	4288	cmd.exe	109
PID 4288 wrote to memory of 4184	4288	cmd.exe	109
PID 4288 wrote to memory of 4184	4288	cmd.exe	109
PID 2244 wrote to memory of 3688	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	116
PID 2244 wrote to memory of 3688	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	116
PID 2244 wrote to memory of 3688	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	116
PID 3688 wrote to memory of 1448	3688	cmd.exe	118
PID 3688 wrote to memory of 1448	3688	cmd.exe	118
PID 3688 wrote to memory of 1448	3688	cmd.exe	118
PID 2244 wrote to memory of 1636	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	124
PID 2244 wrote to memory of 1636	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	124
PID 2244 wrote to memory of 1636	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	124
PID 1636 wrote to memory of 4308	1636	cmd.exe	126
PID 1636 wrote to memory of 4308	1636	cmd.exe	126
PID 1636 wrote to memory of 4308	1636	cmd.exe	126
PID 2244 wrote to memory of 1408	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	127
PID 2244 wrote to memory of 1408	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	127
PID 2244 wrote to memory of 1408	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	127
PID 1408 wrote to memory of 2512	1408	cmd.exe	129
PID 1408 wrote to memory of 2512	1408	cmd.exe	129
PID 1408 wrote to memory of 2512	1408	cmd.exe	129
PID 2244 wrote to memory of 1840	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	130
PID 2244 wrote to memory of 1840	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	130
PID 2244 wrote to memory of 1840	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	130
PID 1840 wrote to memory of 1180	1840	cmd.exe	132
PID 1840 wrote to memory of 1180	1840	cmd.exe	132
PID 1840 wrote to memory of 1180	1840	cmd.exe	132
PID 2244 wrote to memory of 4972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	133
PID 2244 wrote to memory of 4972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	133
PID 2244 wrote to memory of 4972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	133
PID 4972 wrote to memory of 2240	4972	cmd.exe	135
PID 4972 wrote to memory of 2240	4972	cmd.exe	135
PID 4972 wrote to memory of 2240	4972	cmd.exe	135
PID 2244 wrote to memory of 1324	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	136
PID 2244 wrote to memory of 1324	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	136
PID 2244 wrote to memory of 1324	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	136
PID 1324 wrote to memory of 4064	1324	cmd.exe	138
PID 1324 wrote to memory of 4064	1324	cmd.exe	138
PID 1324 wrote to memory of 4064	1324	cmd.exe	138
PID 2244 wrote to memory of 3972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	140
PID 2244 wrote to memory of 3972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	140
PID 2244 wrote to memory of 3972	2244	JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe	140
PID 3972 wrote to memory of 2904	3972	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_23d54773637b1eef3f14db2f9b2c43e6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3368
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C taskkill /f /im twun_32.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im twun_32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads