Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe
- Size 228KB
- Sample261002-legqpsshqc
- SHA256 5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457
- MD5 3fe78b15eef8453bd88d867be7657600
- SHA1 b6d6ceeb883cd8a149f1503b2bb6b0bb727cc789
- SHA512 ec42e0197708b070af673349a350f427b2f22f7ec7c76d80b715cc8a180e5252257ddda1a01bad5ccb9e504d96adb79b945b578ed461616931bbc31c1aa8eb05
- SSDEEP 3072:C05vMnlurPPNJrf/Zy50Vgqq4+tiam3n/C8hmxOUUr3dtAiLy:C05hrPFJr3G0Vpr+tiaOhh4arD0
- TLSH T1213428BEBB02823AE111007C8D0A56B569563E342D2998EBF3D1FF1D24F51E76639387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3652 uyWV20t.exe 1568 uyWV20t.exe 2824 uyWV20t.exe 4172 uyWV20t.exe 4820 uyWV20t.exe 3524 uyWV20t.exe 1412 uyWV20t.exe 2328 uyWV20t.exe 4024 uyWV20t.exe 3600 uyWV20t.exe 3528 uyWV20t.exe 1184 uyWV20t.exe 1264 uyWV20t.exe 204 uyWV20t.exe 868 uyWV20t.exe 2296 uyWV20t.exe 4256 uyWV20t.exe 2336 uyWV20t.exe 2308 uyWV20t.exe 3496 uyWV20t.exe 4632 uyWV20t.exe 4280 uyWV20t.exe 3536 uyWV20t.exe 1840 uyWV20t.exe 3064 uyWV20t.exe 3028 uyWV20t.exe 4612 uyWV20t.exe 1448 uyWV20t.exe 4524 uyWV20t.exe 408 uyWV20t.exe 4624 uyWV20t.exe 4696 uyWV20t.exe 3840 uyWV20t.exe 3312 uyWV20t.exe 1820 uyWV20t.exe 4872 uyWV20t.exe 3392 uyWV20t.exe 4416 uyWV20t.exe 2948 uyWV20t.exe 3240 uyWV20t.exe 2960 uyWV20t.exe 2356 uyWV20t.exe 3480 uyWV20t.exe 3244 uyWV20t.exe 4384 uyWV20t.exe 3104 uyWV20t.exe 4824 uyWV20t.exe 3512 uyWV20t.exe 536 uyWV20t.exe 708 uyWV20t.exe 2640 uyWV20t.exe 3152 uyWV20t.exe 3664 uyWV20t.exe 4540 uyWV20t.exe 2236 uyWV20t.exe 3272 uyWV20t.exe 1176 uyWV20t.exe 4800 uyWV20t.exe 4148 uyWV20t.exe 4532 uyWV20t.exe 2464 uyWV20t.exe 1352 uyWV20t.exe 2212 uyWV20t.exe 5104 uyWV20t.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\g: uyWV20t.exe File opened (read-only) \??\y: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\h: uyWV20t.exe File opened (read-only) \??\v: uyWV20t.exe File opened (read-only) \??\x: uyWV20t.exe File opened (read-only) \??\u: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\z: uyWV20t.exe File opened (read-only) \??\s: uyWV20t.exe File opened (read-only) \??\s: uyWV20t.exe File opened (read-only) \??\e: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\n: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\k: uyWV20t.exe File opened (read-only) \??\e: uyWV20t.exe File opened (read-only) \??\g: uyWV20t.exe File opened (read-only) \??\m: uyWV20t.exe File opened (read-only) \??\l: uyWV20t.exe File opened (read-only) \??\u: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\m: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\l: uyWV20t.exe File opened (read-only) \??\n: uyWV20t.exe File opened (read-only) \??\k: uyWV20t.exe File opened (read-only) \??\s: uyWV20t.exe File opened (read-only) \??\l: uyWV20t.exe File opened (read-only) \??\l: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\h: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\u: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\i: uyWV20t.exe File opened (read-only) \??\k: uyWV20t.exe File opened (read-only) \??\w: uyWV20t.exe File opened (read-only) \??\m: uyWV20t.exe File opened (read-only) \??\o: uyWV20t.exe File opened (read-only) \??\j: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\q: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\p: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\s: uyWV20t.exe File opened (read-only) \??\p: uyWV20t.exe File opened (read-only) \??\k: uyWV20t.exe File opened (read-only) \??\w: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\t: uyWV20t.exe File opened (read-only) \??\r: uyWV20t.exe File opened (read-only) \??\y: uyWV20t.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\uyWV20t\XVe5Ppo.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe File created C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exe uyWV20t.exe - Program crash 1 IoCs
pid pid_target Process 20392 55720 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyWV20t.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2392 jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe Token: SeLoadDriverPrivilege 3652 uyWV20t.exe Token: SeLoadDriverPrivilege 1568 uyWV20t.exe Token: SeLoadDriverPrivilege 2824 uyWV20t.exe Token: SeLoadDriverPrivilege 4172 uyWV20t.exe Token: SeLoadDriverPrivilege 4820 uyWV20t.exe Token: SeLoadDriverPrivilege 3524 uyWV20t.exe Token: SeLoadDriverPrivilege 1412 uyWV20t.exe Token: SeLoadDriverPrivilege 2328 uyWV20t.exe Token: SeLoadDriverPrivilege 4024 uyWV20t.exe Token: SeLoadDriverPrivilege 3600 uyWV20t.exe Token: SeLoadDriverPrivilege 3528 uyWV20t.exe Token: SeLoadDriverPrivilege 1184 uyWV20t.exe Token: SeLoadDriverPrivilege 1264 uyWV20t.exe Token: SeLoadDriverPrivilege 204 uyWV20t.exe Token: SeLoadDriverPrivilege 868 uyWV20t.exe Token: SeLoadDriverPrivilege 2296 uyWV20t.exe Token: SeLoadDriverPrivilege 4256 uyWV20t.exe Token: SeLoadDriverPrivilege 2336 uyWV20t.exe Token: SeLoadDriverPrivilege 2308 uyWV20t.exe Token: SeLoadDriverPrivilege 3496 uyWV20t.exe Token: SeLoadDriverPrivilege 4632 uyWV20t.exe Token: SeLoadDriverPrivilege 4280 uyWV20t.exe Token: SeLoadDriverPrivilege 3536 uyWV20t.exe Token: SeLoadDriverPrivilege 1840 uyWV20t.exe Token: SeLoadDriverPrivilege 3064 uyWV20t.exe Token: SeLoadDriverPrivilege 3028 uyWV20t.exe Token: SeLoadDriverPrivilege 4612 uyWV20t.exe Token: SeLoadDriverPrivilege 1448 uyWV20t.exe Token: SeLoadDriverPrivilege 4524 uyWV20t.exe Token: SeLoadDriverPrivilege 408 uyWV20t.exe Token: SeLoadDriverPrivilege 4624 uyWV20t.exe Token: SeLoadDriverPrivilege 4696 uyWV20t.exe Token: SeLoadDriverPrivilege 3840 uyWV20t.exe Token: SeLoadDriverPrivilege 3312 uyWV20t.exe Token: SeLoadDriverPrivilege 1820 uyWV20t.exe Token: SeLoadDriverPrivilege 4872 uyWV20t.exe Token: SeLoadDriverPrivilege 3392 uyWV20t.exe Token: SeLoadDriverPrivilege 4416 uyWV20t.exe Token: SeLoadDriverPrivilege 2948 uyWV20t.exe Token: SeLoadDriverPrivilege 3240 uyWV20t.exe Token: SeLoadDriverPrivilege 2960 uyWV20t.exe Token: SeLoadDriverPrivilege 2356 uyWV20t.exe Token: SeLoadDriverPrivilege 3480 uyWV20t.exe Token: SeLoadDriverPrivilege 3244 uyWV20t.exe Token: SeLoadDriverPrivilege 4384 uyWV20t.exe Token: SeLoadDriverPrivilege 3104 uyWV20t.exe Token: SeLoadDriverPrivilege 4824 uyWV20t.exe Token: SeLoadDriverPrivilege 3512 uyWV20t.exe Token: SeLoadDriverPrivilege 536 uyWV20t.exe Token: SeLoadDriverPrivilege 708 uyWV20t.exe Token: SeLoadDriverPrivilege 2640 uyWV20t.exe Token: SeLoadDriverPrivilege 3152 uyWV20t.exe Token: SeLoadDriverPrivilege 3664 uyWV20t.exe Token: SeLoadDriverPrivilege 4540 uyWV20t.exe Token: SeLoadDriverPrivilege 2236 uyWV20t.exe Token: SeLoadDriverPrivilege 3272 uyWV20t.exe Token: SeLoadDriverPrivilege 1176 uyWV20t.exe Token: SeLoadDriverPrivilege 4148 uyWV20t.exe Token: SeLoadDriverPrivilege 4532 uyWV20t.exe Token: SeLoadDriverPrivilege 2464 uyWV20t.exe Token: SeLoadDriverPrivilege 1352 uyWV20t.exe Token: SeLoadDriverPrivilege 2212 uyWV20t.exe Token: SeLoadDriverPrivilege 5104 uyWV20t.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 3652 2392 jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe 91 PID 3652 wrote to memory of 1568 3652 uyWV20t.exe 92 PID 1568 wrote to memory of 2824 1568 uyWV20t.exe 93 PID 2824 wrote to memory of 4172 2824 uyWV20t.exe 94 PID 4172 wrote to memory of 4820 4172 uyWV20t.exe 95 PID 4820 wrote to memory of 3524 4820 uyWV20t.exe 96 PID 3524 wrote to memory of 1412 3524 uyWV20t.exe 97 PID 1412 wrote to memory of 2328 1412 uyWV20t.exe 98 PID 2328 wrote to memory of 4024 2328 uyWV20t.exe 99 PID 4024 wrote to memory of 3600 4024 uyWV20t.exe 100 PID 3600 wrote to memory of 3528 3600 uyWV20t.exe 101 PID 3528 wrote to memory of 1184 3528 uyWV20t.exe 102 PID 1184 wrote to memory of 1264 1184 uyWV20t.exe 103 PID 1264 wrote to memory of 204 1264 uyWV20t.exe 104 PID 204 wrote to memory of 868 204 uyWV20t.exe 105 PID 868 wrote to memory of 2296 868 uyWV20t.exe 106 PID 2296 wrote to memory of 4256 2296 uyWV20t.exe 107 PID 4256 wrote to memory of 2336 4256 uyWV20t.exe 108 PID 2336 wrote to memory of 2308 2336 uyWV20t.exe 109 PID 2308 wrote to memory of 3496 2308 uyWV20t.exe 110 PID 3496 wrote to memory of 4632 3496 uyWV20t.exe 111 PID 4632 wrote to memory of 4280 4632 uyWV20t.exe 112 PID 4280 wrote to memory of 3536 4280 uyWV20t.exe 113 PID 3536 wrote to memory of 1840 3536 uyWV20t.exe 114 PID 1840 wrote to memory of 3064 1840 uyWV20t.exe 115 PID 3064 wrote to memory of 3028 3064 uyWV20t.exe 118 PID 3028 wrote to memory of 4612 3028 uyWV20t.exe 119 PID 4612 wrote to memory of 1448 4612 uyWV20t.exe 120 PID 1448 wrote to memory of 4524 1448 uyWV20t.exe 121 PID 4524 wrote to memory of 408 4524 uyWV20t.exe 122 PID 408 wrote to memory of 4624 408 uyWV20t.exe 123 PID 4624 wrote to memory of 4696 4624 uyWV20t.exe 124 PID 4696 wrote to memory of 3840 4696 uyWV20t.exe 125 PID 3840 wrote to memory of 3312 3840 uyWV20t.exe 126 PID 3312 wrote to memory of 1820 3312 uyWV20t.exe 127 PID 1820 wrote to memory of 4872 1820 uyWV20t.exe 128 PID 4872 wrote to memory of 3392 4872 uyWV20t.exe 129 PID 3392 wrote to memory of 4416 3392 uyWV20t.exe 130 PID 4416 wrote to memory of 2948 4416 uyWV20t.exe 131 PID 2948 wrote to memory of 3240 2948 uyWV20t.exe 132 PID 3240 wrote to memory of 2960 3240 uyWV20t.exe 133 PID 2960 wrote to memory of 2356 2960 uyWV20t.exe 134 PID 2356 wrote to memory of 3480 2356 uyWV20t.exe 135 PID 3480 wrote to memory of 3244 3480 uyWV20t.exe 136 PID 3244 wrote to memory of 4384 3244 uyWV20t.exe 137 PID 4384 wrote to memory of 3104 4384 uyWV20t.exe 138 PID 3104 wrote to memory of 4824 3104 uyWV20t.exe 139 PID 4824 wrote to memory of 3512 4824 uyWV20t.exe 140 PID 3512 wrote to memory of 536 3512 uyWV20t.exe 141 PID 536 wrote to memory of 708 536 uyWV20t.exe 142 PID 708 wrote to memory of 2640 708 uyWV20t.exe 143 PID 2640 wrote to memory of 3152 2640 uyWV20t.exe 144 PID 3152 wrote to memory of 3664 3152 uyWV20t.exe 145 PID 3664 wrote to memory of 4540 3664 uyWV20t.exe 146 PID 4540 wrote to memory of 2236 4540 uyWV20t.exe 147 PID 2236 wrote to memory of 3272 2236 uyWV20t.exe 148 PID 3272 wrote to memory of 1176 3272 uyWV20t.exe 149 PID 1176 wrote to memory of 4800 1176 uyWV20t.exe 150 PID 4148 wrote to memory of 4532 4148 uyWV20t.exe 152 PID 4532 wrote to memory of 2464 4532 uyWV20t.exe 153 PID 2464 wrote to memory of 1352 2464 uyWV20t.exe 154 PID 1352 wrote to memory of 2212 1352 uyWV20t.exe 155 PID 2212 wrote to memory of 5104 2212 uyWV20t.exe 156 PID 5104 wrote to memory of 3192 5104 uyWV20t.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5376af36d5e2104a5fbd106c6c0cad062d16cfdc8d58dd905db08c650ec43457.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe5⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe15⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe22⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe25⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe28⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe32⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe43⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe48⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe51⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe53⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe59⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe66⤵PID:3192
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe67⤵PID:3008
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe68⤵
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe69⤵PID:2860
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe70⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe71⤵PID:4864
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe72⤵
- Enumerates connected drives
PID:2008 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe73⤵PID:5032
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe74⤵PID:2384
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe75⤵PID:208
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe76⤵
- Enumerates connected drives
PID:4160 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe77⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe78⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe79⤵
- Drops file in System32 directory
PID:820 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe80⤵
- Drops file in System32 directory
PID:1632 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe81⤵
- Enumerates connected drives
PID:4748 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe82⤵
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe83⤵PID:3148
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe84⤵PID:3380
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe85⤵PID:5136
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe86⤵PID:5152
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe87⤵
- Enumerates connected drives
PID:5168 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe88⤵PID:5184
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe89⤵
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe90⤵PID:5216
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe91⤵
- Enumerates connected drives
PID:5232 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe92⤵PID:5248
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe93⤵
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe94⤵
- Drops file in System32 directory
PID:5280 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe95⤵
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe96⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe97⤵
- Drops file in System32 directory
PID:5352 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe98⤵
- Drops file in System32 directory
PID:5388 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe99⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe100⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe101⤵
- Enumerates connected drives
PID:5472 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe102⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe103⤵
- System Location Discovery: System Language Discovery
PID:5508 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe104⤵
- Enumerates connected drives
PID:5524 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe105⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5556 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe106⤵PID:5584
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe107⤵PID:5604
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe108⤵PID:5636
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe109⤵
- Enumerates connected drives
PID:5668 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe110⤵PID:5700
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe111⤵
- Enumerates connected drives
PID:5720 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe112⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe113⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5764 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe114⤵PID:5780
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe115⤵PID:5800
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe116⤵
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe117⤵
- Enumerates connected drives
PID:5840 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe118⤵PID:5860
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe119⤵PID:5880
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe120⤵PID:5904
-
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe121⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\Windows\SysWOW64\XVe5Ppo\uyWV20t.exeC:\Windows\system32\XVe5Ppo\uyWV20t.exe122⤵PID:5940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-