Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Picture42.JPG_www.facebook.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Picture42.JPG_www.facebook.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Picture42.JPG_www.facebook.exe
-
Size
151KB
-
MD5
3bb29b4fa89ba0623b2668c44fc545dd
-
SHA1
ce273211fa397c88e6af808b0ab20d77f33861c7
-
SHA256
af34aa041818cb31b37c636e019ca464044e2fefacfb6da0abefba856abbbc6d
-
SHA512
5c418b4dc0d19f6df33bfef4ff8a9eeafd83e44eff12dd6304f848a36c9dbe5c689c65b94cc04433828b6dc6d10ea838888018be2274e26496470ac64537d6d0
-
SSDEEP
3072:1YXlOvh+trjeCUwV3ZC3Tfbv4OyWrHXBUtLBf:1kjetiZK3vXLX6LBf
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation Picture42.JPG_www.facebook.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation wmpdlr32.exe -
Deletes itself 1 IoCs
pid Process 4604 wmpdlr32.exe -
Executes dropped EXE 30 IoCs
pid Process 4704 wmpdlr32.exe 4604 wmpdlr32.exe 4496 wmpdlr32.exe 1496 wmpdlr32.exe 3404 wmpdlr32.exe 3052 wmpdlr32.exe 1956 wmpdlr32.exe 2668 wmpdlr32.exe 4320 wmpdlr32.exe 4316 wmpdlr32.exe 3924 wmpdlr32.exe 4640 wmpdlr32.exe 844 wmpdlr32.exe 2720 wmpdlr32.exe 3348 wmpdlr32.exe 5080 wmpdlr32.exe 2320 wmpdlr32.exe 4308 wmpdlr32.exe 1524 wmpdlr32.exe 4632 wmpdlr32.exe 5016 wmpdlr32.exe 5028 wmpdlr32.exe 1600 wmpdlr32.exe 868 wmpdlr32.exe 336 wmpdlr32.exe 1236 wmpdlr32.exe 1944 wmpdlr32.exe 1580 wmpdlr32.exe 660 wmpdlr32.exe 2692 wmpdlr32.exe -
resource yara_rule behavioral2/memory/4092-0-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4092-2-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4092-4-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4092-41-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4604-43-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4092-45-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4604-50-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4604-54-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1496-60-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1496-62-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3052-70-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4316-78-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2668-80-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4316-88-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4640-96-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2720-105-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4308-113-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/5080-114-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4632-121-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4308-125-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4632-135-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/868-141-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/5028-145-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1236-151-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/868-155-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1580-163-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1236-166-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1580-176-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 32 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Picture42.JPG_www.facebook.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Picture42.JPG_www.facebook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdlr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdlr32.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ Picture42.JPG_www.facebook.exe File created C:\Windows\SysWOW64\wmpdlr32.exe Picture42.JPG_www.facebook.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\ wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe Picture42.JPG_www.facebook.exe File opened for modification C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe File created C:\Windows\SysWOW64\wmpdlr32.exe wmpdlr32.exe -
Suspicious use of SetThreadContext 16 IoCs
description pid Process procid_target PID 948 set thread context of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 4704 set thread context of 4604 4704 wmpdlr32.exe 92 PID 4496 set thread context of 1496 4496 wmpdlr32.exe 94 PID 3404 set thread context of 3052 3404 wmpdlr32.exe 98 PID 1956 set thread context of 2668 1956 wmpdlr32.exe 100 PID 4320 set thread context of 4316 4320 wmpdlr32.exe 103 PID 3924 set thread context of 4640 3924 wmpdlr32.exe 105 PID 844 set thread context of 2720 844 wmpdlr32.exe 107 PID 3348 set thread context of 5080 3348 wmpdlr32.exe 109 PID 2320 set thread context of 4308 2320 wmpdlr32.exe 111 PID 1524 set thread context of 4632 1524 wmpdlr32.exe 113 PID 5016 set thread context of 5028 5016 wmpdlr32.exe 115 PID 1600 set thread context of 868 1600 wmpdlr32.exe 117 PID 336 set thread context of 1236 336 wmpdlr32.exe 119 PID 1944 set thread context of 1580 1944 wmpdlr32.exe 121 PID 660 set thread context of 2692 660 wmpdlr32.exe 123 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Picture42.JPG_www.facebook.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdlr32.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4092 Picture42.JPG_www.facebook.exe 4092 Picture42.JPG_www.facebook.exe 4092 Picture42.JPG_www.facebook.exe 4092 Picture42.JPG_www.facebook.exe 4604 wmpdlr32.exe 4604 wmpdlr32.exe 4604 wmpdlr32.exe 4604 wmpdlr32.exe 1496 wmpdlr32.exe 1496 wmpdlr32.exe 1496 wmpdlr32.exe 1496 wmpdlr32.exe 3052 wmpdlr32.exe 3052 wmpdlr32.exe 3052 wmpdlr32.exe 3052 wmpdlr32.exe 2668 wmpdlr32.exe 2668 wmpdlr32.exe 2668 wmpdlr32.exe 2668 wmpdlr32.exe 4316 wmpdlr32.exe 4316 wmpdlr32.exe 4316 wmpdlr32.exe 4316 wmpdlr32.exe 4640 wmpdlr32.exe 4640 wmpdlr32.exe 4640 wmpdlr32.exe 4640 wmpdlr32.exe 2720 wmpdlr32.exe 2720 wmpdlr32.exe 2720 wmpdlr32.exe 2720 wmpdlr32.exe 5080 wmpdlr32.exe 5080 wmpdlr32.exe 5080 wmpdlr32.exe 5080 wmpdlr32.exe 4308 wmpdlr32.exe 4308 wmpdlr32.exe 4308 wmpdlr32.exe 4308 wmpdlr32.exe 4632 wmpdlr32.exe 4632 wmpdlr32.exe 4632 wmpdlr32.exe 4632 wmpdlr32.exe 5028 wmpdlr32.exe 5028 wmpdlr32.exe 5028 wmpdlr32.exe 5028 wmpdlr32.exe 868 wmpdlr32.exe 868 wmpdlr32.exe 868 wmpdlr32.exe 868 wmpdlr32.exe 1236 wmpdlr32.exe 1236 wmpdlr32.exe 1236 wmpdlr32.exe 1236 wmpdlr32.exe 1580 wmpdlr32.exe 1580 wmpdlr32.exe 1580 wmpdlr32.exe 1580 wmpdlr32.exe 2692 wmpdlr32.exe 2692 wmpdlr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 948 wrote to memory of 4092 948 Picture42.JPG_www.facebook.exe 85 PID 4092 wrote to memory of 4704 4092 Picture42.JPG_www.facebook.exe 91 PID 4092 wrote to memory of 4704 4092 Picture42.JPG_www.facebook.exe 91 PID 4092 wrote to memory of 4704 4092 Picture42.JPG_www.facebook.exe 91 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4704 wrote to memory of 4604 4704 wmpdlr32.exe 92 PID 4604 wrote to memory of 4496 4604 wmpdlr32.exe 93 PID 4604 wrote to memory of 4496 4604 wmpdlr32.exe 93 PID 4604 wrote to memory of 4496 4604 wmpdlr32.exe 93 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 4496 wrote to memory of 1496 4496 wmpdlr32.exe 94 PID 1496 wrote to memory of 3404 1496 wmpdlr32.exe 97 PID 1496 wrote to memory of 3404 1496 wmpdlr32.exe 97 PID 1496 wrote to memory of 3404 1496 wmpdlr32.exe 97 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3404 wrote to memory of 3052 3404 wmpdlr32.exe 98 PID 3052 wrote to memory of 1956 3052 wmpdlr32.exe 99 PID 3052 wrote to memory of 1956 3052 wmpdlr32.exe 99 PID 3052 wrote to memory of 1956 3052 wmpdlr32.exe 99 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 1956 wrote to memory of 2668 1956 wmpdlr32.exe 100 PID 2668 wrote to memory of 4320 2668 wmpdlr32.exe 102 PID 2668 wrote to memory of 4320 2668 wmpdlr32.exe 102 PID 2668 wrote to memory of 4320 2668 wmpdlr32.exe 102 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4320 wrote to memory of 4316 4320 wmpdlr32.exe 103 PID 4316 wrote to memory of 3924 4316 wmpdlr32.exe 104 PID 4316 wrote to memory of 3924 4316 wmpdlr32.exe 104 PID 4316 wrote to memory of 3924 4316 wmpdlr32.exe 104 PID 3924 wrote to memory of 4640 3924 wmpdlr32.exe 105 PID 3924 wrote to memory of 4640 3924 wmpdlr32.exe 105 PID 3924 wrote to memory of 4640 3924 wmpdlr32.exe 105 PID 3924 wrote to memory of 4640 3924 wmpdlr32.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\Picture42.JPG_www.facebook.exe"C:\Users\Admin\AppData\Local\Temp\Picture42.JPG_www.facebook.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\Picture42.JPG_www.facebook.exe"C:\Users\Admin\AppData\Local\Temp\Picture42.JPG_www.facebook.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Users\Admin\AppData\Local\Temp\PICTUR~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Users\Admin\AppData\Local\Temp\PICTUR~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4640 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:844 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3348 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5080 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2320 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4308 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1524 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4632 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5016 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1600 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:868 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:336 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1236 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1944 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:660 -
C:\Windows\SysWOW64\wmpdlr32.exe"C:\Windows\system32\wmpdlr32.exe" C:\Windows\SysWOW64\wmpdlr32.exe32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD551464df0b01d38436dec9c3d58999688
SHA18426a75f28daf1fc1e370172bd9312ff54a93065
SHA25606bf391a2b32f3657839878cb7ae5fc398687cada0e21d1f5e364d9391e8e12c
SHA5128b68e726a9066c4c548bc012d38b5aa7dc1b1039401ecb53f468e491473b21c1e50baffe2fb54885f0e770247154c39cbdb504f65d9532bf8db415b696164c5f
-
Filesize
151KB
MD53bb29b4fa89ba0623b2668c44fc545dd
SHA1ce273211fa397c88e6af808b0ab20d77f33861c7
SHA256af34aa041818cb31b37c636e019ca464044e2fefacfb6da0abefba856abbbc6d
SHA5125c418b4dc0d19f6df33bfef4ff8a9eeafd83e44eff12dd6304f848a36c9dbe5c689c65b94cc04433828b6dc6d10ea838888018be2274e26496470ac64537d6d0