Analysis
- max time kernel
20s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe
- Size 192KB
- Sample260919-mcbmcast3m
- SHA256 d270ab5f79227a1ec470095419b007e1bfc13df097d3e70c0be054ae734b8efb
- MD5 8c813f40680f8b8333dae04522ee81a7
- SHA1 15b1d8af0b2bdb2287590b936dde554ad9ca52b2
- SHA512 4ff82d5467bc32aeb8e8559e29423442aa7884cd3c15a79beaf23a8d9931a470664e436d341b36afbeffa7c99bd7c86746d0d5bc9dee0dca27651d2cb42c1a2f
- SSDEEP 3072:hpUaHV71L4KDvQf/m7hzAl7frkNnEqQhFNf5L9UpUaHV71L4KDvQf/m7hzAl7fr0:hpFJ4faJJE9kpFJ4faJJE9U
- TLSH T144144A07F2E18C73E2F11A7C9C19B264987FBE212D291B4AB7A80D8D5D3D2C1594C6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4652 msgr32.exe 3272 msgr32.exe 3068 msgr32.exe 4192 msgr32.exe 1472 msgr32.exe 4252 msgr32.exe 6036 msgr32.exe 3440 msgr32.exe 4916 msgr32.exe 2772 msgr32.exe 2740 msgr32.exe 5752 msgr32.exe 5920 msgr32.exe 5112 msgr32.exe 6032 msgr32.exe 3784 msgr32.exe 4064 msgr32.exe 5728 msgr32.exe 1308 msgr32.exe 4900 msgr32.exe 4012 msgr32.exe 4180 msgr32.exe 4912 msgr32.exe 2916 msgr32.exe 832 msgr32.exe 3064 msgr32.exe 1144 msgr32.exe 4080 msgr32.exe 6008 msgr32.exe 5660 msgr32.exe 1680 msgr32.exe 1300 msgr32.exe 3936 msgr32.exe 5864 msgr32.exe 4824 msgr32.exe 4600 msgr32.exe 5124 msgr32.exe 1796 msgr32.exe 3624 msgr32.exe 4492 msgr32.exe 5324 msgr32.exe 4488 msgr32.exe 5012 msgr32.exe 1188 msgr32.exe 1528 msgr32.exe 2844 msgr32.exe 4556 msgr32.exe 3124 msgr32.exe 4884 msgr32.exe 4832 msgr32.exe 4948 msgr32.exe 1584 msgr32.exe 5844 msgr32.exe 1384 msgr32.exe 4516 msgr32.exe 5032 msgr32.exe 4532 msgr32.exe 5208 msgr32.exe 5100 msgr32.exe 2788 msgr32.exe 2696 msgr32.exe 3548 msgr32.exe 5456 msgr32.exe 1184 msgr32.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Plugin = "C:\\Windows\\system32\\msgr32.exe" msgr32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe File created C:\Windows\SysWOW64\msgr32.exe msgr32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msgr32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4652 1072 jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe 88 PID 4652 wrote to memory of 3272 4652 msgr32.exe 89 PID 3272 wrote to memory of 3068 3272 msgr32.exe 90 PID 3068 wrote to memory of 4192 3068 msgr32.exe 91 PID 4192 wrote to memory of 1472 4192 msgr32.exe 93 PID 1472 wrote to memory of 4252 1472 msgr32.exe 94 PID 4252 wrote to memory of 6036 4252 msgr32.exe 95 PID 6036 wrote to memory of 3440 6036 msgr32.exe 96 PID 3440 wrote to memory of 4916 3440 msgr32.exe 97 PID 4916 wrote to memory of 2772 4916 msgr32.exe 98 PID 2772 wrote to memory of 2740 2772 msgr32.exe 99 PID 2740 wrote to memory of 5752 2740 msgr32.exe 100 PID 5752 wrote to memory of 5920 5752 msgr32.exe 101 PID 5920 wrote to memory of 5112 5920 msgr32.exe 102 PID 5112 wrote to memory of 6032 5112 msgr32.exe 103 PID 6032 wrote to memory of 3784 6032 msgr32.exe 104 PID 3784 wrote to memory of 4064 3784 msgr32.exe 105 PID 4064 wrote to memory of 5728 4064 msgr32.exe 106 PID 5728 wrote to memory of 1308 5728 msgr32.exe 107 PID 1308 wrote to memory of 4900 1308 msgr32.exe 108 PID 4900 wrote to memory of 4012 4900 msgr32.exe 109 PID 4012 wrote to memory of 4180 4012 msgr32.exe 110 PID 4180 wrote to memory of 4912 4180 msgr32.exe 111 PID 4912 wrote to memory of 2916 4912 msgr32.exe 112 PID 2916 wrote to memory of 832 2916 msgr32.exe 113 PID 832 wrote to memory of 3064 832 msgr32.exe 114 PID 3064 wrote to memory of 1144 3064 msgr32.exe 115 PID 1144 wrote to memory of 4080 1144 msgr32.exe 116 PID 4080 wrote to memory of 6008 4080 msgr32.exe 117 PID 6008 wrote to memory of 5660 6008 msgr32.exe 118 PID 5660 wrote to memory of 1680 5660 msgr32.exe 119 PID 1680 wrote to memory of 1300 1680 msgr32.exe 120 PID 1300 wrote to memory of 3936 1300 msgr32.exe 121 PID 3936 wrote to memory of 5864 3936 msgr32.exe 122 PID 5864 wrote to memory of 4824 5864 msgr32.exe 123 PID 4824 wrote to memory of 4600 4824 msgr32.exe 124 PID 4600 wrote to memory of 5124 4600 msgr32.exe 125 PID 5124 wrote to memory of 1796 5124 msgr32.exe 126 PID 1796 wrote to memory of 3624 1796 msgr32.exe 127 PID 3624 wrote to memory of 4492 3624 msgr32.exe 128 PID 4492 wrote to memory of 5324 4492 msgr32.exe 129 PID 5324 wrote to memory of 4488 5324 msgr32.exe 130 PID 4488 wrote to memory of 5012 4488 msgr32.exe 131 PID 5012 wrote to memory of 1188 5012 msgr32.exe 132 PID 1188 wrote to memory of 1528 1188 msgr32.exe 133 PID 1528 wrote to memory of 2844 1528 msgr32.exe 134 PID 2844 wrote to memory of 4556 2844 msgr32.exe 135 PID 4556 wrote to memory of 3124 4556 msgr32.exe 136 PID 3124 wrote to memory of 4884 3124 msgr32.exe 137 PID 4884 wrote to memory of 4832 4884 msgr32.exe 138 PID 4832 wrote to memory of 4948 4832 msgr32.exe 139 PID 4948 wrote to memory of 1584 4948 msgr32.exe 140 PID 1584 wrote to memory of 5844 1584 msgr32.exe 141 PID 5844 wrote to memory of 1384 5844 msgr32.exe 142 PID 1384 wrote to memory of 4516 1384 msgr32.exe 143 PID 4516 wrote to memory of 5032 4516 msgr32.exe 144 PID 5032 wrote to memory of 4532 5032 msgr32.exe 145 PID 4532 wrote to memory of 5208 4532 msgr32.exe 146 PID 5208 wrote to memory of 5100 5208 msgr32.exe 147 PID 5100 wrote to memory of 2788 5100 msgr32.exe 148 PID 2788 wrote to memory of 2696 2788 msgr32.exe 149 PID 2696 wrote to memory of 3548 2696 msgr32.exe 150 PID 3548 wrote to memory of 5456 3548 msgr32.exe 151 PID 5456 wrote to memory of 1184 5456 msgr32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8c813f40680f8b8333dae04522ee81a7.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"13⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"17⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"18⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"21⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"22⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"23⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"24⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"27⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"30⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"33⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"36⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"38⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"40⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"43⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"45⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"46⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"47⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"49⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"50⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"56⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"60⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"61⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"64⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1184 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"66⤵
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"67⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"68⤵PID:3460
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"69⤵
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"70⤵
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"71⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2152 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"72⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"73⤵
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"74⤵PID:6000
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"75⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"76⤵
- Drops file in System32 directory
PID:1536 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"77⤵
- Drops file in System32 directory
PID:812 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"78⤵
- Adds Run key to start application
PID:4188 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"79⤵PID:1924
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"80⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:980 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"81⤵
- Drops file in System32 directory
PID:3120 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"82⤵
- Adds Run key to start application
PID:2884 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"83⤵
- Drops file in System32 directory
PID:4592 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"84⤵PID:1608
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"85⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"86⤵PID:5148
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"87⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"88⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"89⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"90⤵
- Adds Run key to start application
PID:5444 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"91⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"92⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"93⤵
- Drops file in System32 directory
PID:4404 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"94⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"95⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5316 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"96⤵PID:5548
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"97⤵
- Drops file in System32 directory
PID:4944 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"98⤵
- Adds Run key to start application
PID:2824 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"99⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"100⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"101⤵
- Drops file in System32 directory
PID:4544 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"103⤵PID:3344
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"104⤵
- Drops file in System32 directory
PID:4124 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"105⤵
- Adds Run key to start application
PID:4376 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"106⤵PID:4684
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"107⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3220 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"108⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"109⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"110⤵
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"111⤵PID:1936
-
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"113⤵
- Drops file in System32 directory
PID:5836 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"114⤵
- Adds Run key to start application
PID:3552 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"115⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"116⤵
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"117⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"118⤵
- Drops file in System32 directory
PID:5604 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"119⤵
- Drops file in System32 directory
PID:5992 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"120⤵
- Drops file in System32 directory
PID:1780 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"121⤵
- Adds Run key to start application
PID:4712 -
C:\Windows\SysWOW64\msgr32.exe"C:\Windows\system32\msgr32.exe" "C:\Windows\SysWOW64\msgr32.exe"122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-