Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
24/01/2024, 01:14
General
- Target 710d0f94bdbafa9c8fea31e1cee68ec3.exe
- Size 138KB
- Sample240124-bl13taegf8
- SHA256 8189ce03cc9aaf3bff8a2880ec7e43809858af1e16db629b86be33d6c9557fcb
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 51 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\710d0f94bdbafa9c8fea31e1cee68ec3.exe"C:\Users\Admin\AppData\Local\Temp\710d0f94bdbafa9c8fea31e1cee68ec3.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\710d0f94bdbafa9c8fea31e1cee68ec3.exeC:\Users\Admin\AppData\Local\Temp\710d0f94bdbafa9c8fea31e1cee68ec3.exe2⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Users\Admin\AppData\Local\Temp\710D0F~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe67⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe68⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe69⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe70⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe71⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe72⤵
- Checks computer location settings
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe73⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe74⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe75⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe76⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe77⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe78⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe79⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe81⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe82⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe83⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe84⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe85⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe86⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe87⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe88⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe89⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe90⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe91⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe92⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe93⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe94⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe95⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe96⤵
- Checks computer location settings
- Maps connected drives based on registry
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe97⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe98⤵
- Checks computer location settings
- Maps connected drives based on registry
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe99⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe100⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
-
C:\Windows\SysWOW64\wmpxr3.exe"C:\Windows\system32\wmpxr3.exe" C:\Windows\SysWOW64\wmpxr3.exe101⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SysWOW64\wmpxr3.exeC:\Windows\SysWOW64\wmpxr3.exe102⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wmpxr3.exe
wmpxr3.exe
wmpxr3.exe
memory/860-214-0x0000000000400000-0x0000000000466000-memory.dmp
memory/864-333-0x0000000000400000-0x0000000000466000-memory.dmp
memory/864-330-0x0000000000400000-0x0000000000466000-memory.dmp
memory/896-51-0x0000000000400000-0x0000000000466000-memory.dmp
memory/896-53-0x0000000000400000-0x0000000000466000-memory.dmp
memory/896-54-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1124-220-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1124-224-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1348-185-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1364-322-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1364-325-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1480-261-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1480-258-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1708-42-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1708-44-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1708-46-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1764-376-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1764-380-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1904-249-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1904-253-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2156-157-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2264-62-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2264-61-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2264-63-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2368-349-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2368-346-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2504-293-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2504-290-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2584-266-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2584-269-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2688-317-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2688-303-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2748-420-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2748-417-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2776-364-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2776-361-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3032-356-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3192-129-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3208-83-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3208-81-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3208-79-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3332-119-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3384-396-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3384-392-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3436-285-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3436-282-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3496-166-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3520-92-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3604-298-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3604-301-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3720-412-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3720-408-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4100-388-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4100-385-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4260-147-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4340-234-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4340-229-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4344-201-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4344-205-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4360-243-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4420-277-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4420-274-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4668-73-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4824-404-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4824-401-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4876-108-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4876-111-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4928-97-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4928-101-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4928-99-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4928-98-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4964-0-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4964-36-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4964-3-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4964-2-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5028-176-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5036-195-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5048-138-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5068-337-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5068-341-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5104-368-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5104-372-0x0000000000400000-0x0000000000466000-memory.dmp