Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 23:44
Static task
static1
Behavioral task
behavioral1
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
-
Size
198KB
-
MD5
f9038f1859b2e5d7f4a2d9a1aafb4f3e
-
SHA1
52ef34a49bfb8a7a0149fe24915daacd2b229d48
-
SHA256
5302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
-
SHA512
f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af
-
SSDEEP
3072:LAavosgPrJiX94Pp5H+tnp1ezSt+CFmngL2LvnUhxdmOw4YHLQM2HysCfx:LAog2p1AS1FmvvI8xQvSXx
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2476 wmpdtc32.exe -
Executes dropped EXE 24 IoCs
pid Process 2608 wmpdtc32.exe 2476 wmpdtc32.exe 2764 wmpdtc32.exe 2784 wmpdtc32.exe 2432 wmpdtc32.exe 1440 wmpdtc32.exe 1416 wmpdtc32.exe 2204 wmpdtc32.exe 2832 wmpdtc32.exe 2200 wmpdtc32.exe 1152 wmpdtc32.exe 1940 wmpdtc32.exe 1988 wmpdtc32.exe 1032 wmpdtc32.exe 2920 wmpdtc32.exe 1744 wmpdtc32.exe 2888 wmpdtc32.exe 2736 wmpdtc32.exe 1888 wmpdtc32.exe 1040 wmpdtc32.exe 2232 wmpdtc32.exe 1084 wmpdtc32.exe 2844 wmpdtc32.exe 1884 wmpdtc32.exe -
Loads dropped DLL 24 IoCs
pid Process 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 2608 wmpdtc32.exe 2476 wmpdtc32.exe 2764 wmpdtc32.exe 2784 wmpdtc32.exe 2432 wmpdtc32.exe 1440 wmpdtc32.exe 1416 wmpdtc32.exe 2204 wmpdtc32.exe 2832 wmpdtc32.exe 2200 wmpdtc32.exe 1152 wmpdtc32.exe 1940 wmpdtc32.exe 1988 wmpdtc32.exe 1032 wmpdtc32.exe 2920 wmpdtc32.exe 1744 wmpdtc32.exe 2888 wmpdtc32.exe 2736 wmpdtc32.exe 1888 wmpdtc32.exe 1040 wmpdtc32.exe 2232 wmpdtc32.exe 1084 wmpdtc32.exe 2844 wmpdtc32.exe -
resource yara_rule behavioral1/memory/2992-4-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-6-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-7-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-10-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-12-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-13-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-11-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-19-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2992-29-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-42-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-45-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-47-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-67-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-68-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2476-82-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2784-85-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2784-90-0x0000000003430000-0x000000000346C000-memory.dmp upx behavioral1/memory/2784-93-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-107-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-106-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-108-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-109-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-110-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-112-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1440-126-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2204-159-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2204-161-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2204-175-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2200-210-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2200-222-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1940-230-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1940-247-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1032-281-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1032-294-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1744-301-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1744-318-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2736-354-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2736-367-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1040-374-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1040-393-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1084-427-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1084-439-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1884-448-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 26 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe -
Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 2872 set thread context of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2608 set thread context of 2476 2608 wmpdtc32.exe 30 PID 2764 set thread context of 2784 2764 wmpdtc32.exe 32 PID 2432 set thread context of 1440 2432 wmpdtc32.exe 34 PID 1416 set thread context of 2204 1416 wmpdtc32.exe 38 PID 2832 set thread context of 2200 2832 wmpdtc32.exe 40 PID 1152 set thread context of 1940 1152 wmpdtc32.exe 42 PID 1988 set thread context of 1032 1988 wmpdtc32.exe 44 PID 2920 set thread context of 1744 2920 wmpdtc32.exe 46 PID 2888 set thread context of 2736 2888 wmpdtc32.exe 48 PID 1888 set thread context of 1040 1888 wmpdtc32.exe 50 PID 2232 set thread context of 1084 2232 wmpdtc32.exe 52 PID 2844 set thread context of 1884 2844 wmpdtc32.exe 54 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 2476 wmpdtc32.exe 2476 wmpdtc32.exe 2784 wmpdtc32.exe 2784 wmpdtc32.exe 1440 wmpdtc32.exe 1440 wmpdtc32.exe 2204 wmpdtc32.exe 2204 wmpdtc32.exe 2200 wmpdtc32.exe 2200 wmpdtc32.exe 1940 wmpdtc32.exe 1940 wmpdtc32.exe 1032 wmpdtc32.exe 1032 wmpdtc32.exe 1744 wmpdtc32.exe 1744 wmpdtc32.exe 2736 wmpdtc32.exe 2736 wmpdtc32.exe 1040 wmpdtc32.exe 1040 wmpdtc32.exe 1084 wmpdtc32.exe 1084 wmpdtc32.exe 1884 wmpdtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2872 wrote to memory of 2992 2872 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 28 PID 2992 wrote to memory of 2608 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 29 PID 2992 wrote to memory of 2608 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 29 PID 2992 wrote to memory of 2608 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 29 PID 2992 wrote to memory of 2608 2992 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 29 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2608 wrote to memory of 2476 2608 wmpdtc32.exe 30 PID 2476 wrote to memory of 2764 2476 wmpdtc32.exe 31 PID 2476 wrote to memory of 2764 2476 wmpdtc32.exe 31 PID 2476 wrote to memory of 2764 2476 wmpdtc32.exe 31 PID 2476 wrote to memory of 2764 2476 wmpdtc32.exe 31 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2764 wrote to memory of 2784 2764 wmpdtc32.exe 32 PID 2784 wrote to memory of 2432 2784 wmpdtc32.exe 33 PID 2784 wrote to memory of 2432 2784 wmpdtc32.exe 33 PID 2784 wrote to memory of 2432 2784 wmpdtc32.exe 33 PID 2784 wrote to memory of 2432 2784 wmpdtc32.exe 33 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 2432 wrote to memory of 1440 2432 wmpdtc32.exe 34 PID 1440 wrote to memory of 1416 1440 wmpdtc32.exe 37 PID 1440 wrote to memory of 1416 1440 wmpdtc32.exe 37 PID 1440 wrote to memory of 1416 1440 wmpdtc32.exe 37 PID 1440 wrote to memory of 1416 1440 wmpdtc32.exe 37 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 1416 wrote to memory of 2204 1416 wmpdtc32.exe 38 PID 2204 wrote to memory of 2832 2204 wmpdtc32.exe 39 PID 2204 wrote to memory of 2832 2204 wmpdtc32.exe 39 PID 2204 wrote to memory of 2832 2204 wmpdtc32.exe 39 PID 2204 wrote to memory of 2832 2204 wmpdtc32.exe 39 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2832 wrote to memory of 2200 2832 wmpdtc32.exe 40 PID 2200 wrote to memory of 1152 2200 wmpdtc32.exe 41 PID 2200 wrote to memory of 1152 2200 wmpdtc32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1152 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1988 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1032 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2920 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1744 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2888 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1888 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1040 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2232 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1084 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2844 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe26⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD5f9038f1859b2e5d7f4a2d9a1aafb4f3e
SHA152ef34a49bfb8a7a0149fe24915daacd2b229d48
SHA2565302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
SHA512f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af