Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 23:44
Static task
static1
Behavioral task
behavioral1
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
-
Size
198KB
-
MD5
f9038f1859b2e5d7f4a2d9a1aafb4f3e
-
SHA1
52ef34a49bfb8a7a0149fe24915daacd2b229d48
-
SHA256
5302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
-
SHA512
f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af
-
SSDEEP
3072:LAavosgPrJiX94Pp5H+tnp1ezSt+CFmngL2LvnUhxdmOw4YHLQM2HysCfx:LAog2p1AS1FmvvI8xQvSXx
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation wmpdtc32.exe -
Deletes itself 1 IoCs
pid Process 4260 wmpdtc32.exe -
Executes dropped EXE 28 IoCs
pid Process 2752 wmpdtc32.exe 4260 wmpdtc32.exe 4392 wmpdtc32.exe 4960 wmpdtc32.exe 3184 wmpdtc32.exe 4852 wmpdtc32.exe 1064 wmpdtc32.exe 3796 wmpdtc32.exe 4348 wmpdtc32.exe 1320 wmpdtc32.exe 3512 wmpdtc32.exe 4716 wmpdtc32.exe 3788 wmpdtc32.exe 1484 wmpdtc32.exe 4400 wmpdtc32.exe 2000 wmpdtc32.exe 5036 wmpdtc32.exe 3648 wmpdtc32.exe 2936 wmpdtc32.exe 2940 wmpdtc32.exe 3316 wmpdtc32.exe 4440 wmpdtc32.exe 4564 wmpdtc32.exe 2272 wmpdtc32.exe 1352 wmpdtc32.exe 1524 wmpdtc32.exe 4552 wmpdtc32.exe 3256 wmpdtc32.exe -
resource yara_rule behavioral2/memory/1800-1-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1800-4-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1800-5-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1800-6-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1800-39-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4260-56-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1800-57-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4260-60-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4960-68-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4260-69-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4960-77-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4852-81-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4852-88-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3796-89-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3796-93-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1320-100-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3796-102-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1320-105-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4716-112-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1320-114-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4716-117-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4716-124-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1484-128-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1484-135-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2000-139-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2000-146-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3648-160-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2940-171-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4440-184-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2272-196-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1524-207-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe -
Drops file in System32 directory 42 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 3624 set thread context of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 2752 set thread context of 4260 2752 wmpdtc32.exe 90 PID 4392 set thread context of 4960 4392 wmpdtc32.exe 92 PID 3184 set thread context of 4852 3184 wmpdtc32.exe 96 PID 1064 set thread context of 3796 1064 wmpdtc32.exe 99 PID 4348 set thread context of 1320 4348 wmpdtc32.exe 102 PID 3512 set thread context of 4716 3512 wmpdtc32.exe 104 PID 3788 set thread context of 1484 3788 wmpdtc32.exe 106 PID 4400 set thread context of 2000 4400 wmpdtc32.exe 108 PID 5036 set thread context of 3648 5036 wmpdtc32.exe 110 PID 2936 set thread context of 2940 2936 wmpdtc32.exe 112 PID 3316 set thread context of 4440 3316 wmpdtc32.exe 114 PID 4564 set thread context of 2272 4564 wmpdtc32.exe 116 PID 1352 set thread context of 1524 1352 wmpdtc32.exe 118 PID 4552 set thread context of 3256 4552 wmpdtc32.exe 120 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 4260 wmpdtc32.exe 4260 wmpdtc32.exe 4260 wmpdtc32.exe 4260 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 4852 wmpdtc32.exe 4852 wmpdtc32.exe 4852 wmpdtc32.exe 4852 wmpdtc32.exe 3796 wmpdtc32.exe 3796 wmpdtc32.exe 3796 wmpdtc32.exe 3796 wmpdtc32.exe 1320 wmpdtc32.exe 1320 wmpdtc32.exe 1320 wmpdtc32.exe 1320 wmpdtc32.exe 4716 wmpdtc32.exe 4716 wmpdtc32.exe 4716 wmpdtc32.exe 4716 wmpdtc32.exe 1484 wmpdtc32.exe 1484 wmpdtc32.exe 1484 wmpdtc32.exe 1484 wmpdtc32.exe 2000 wmpdtc32.exe 2000 wmpdtc32.exe 2000 wmpdtc32.exe 2000 wmpdtc32.exe 3648 wmpdtc32.exe 3648 wmpdtc32.exe 3648 wmpdtc32.exe 3648 wmpdtc32.exe 2940 wmpdtc32.exe 2940 wmpdtc32.exe 2940 wmpdtc32.exe 2940 wmpdtc32.exe 4440 wmpdtc32.exe 4440 wmpdtc32.exe 4440 wmpdtc32.exe 4440 wmpdtc32.exe 2272 wmpdtc32.exe 2272 wmpdtc32.exe 2272 wmpdtc32.exe 2272 wmpdtc32.exe 1524 wmpdtc32.exe 1524 wmpdtc32.exe 1524 wmpdtc32.exe 1524 wmpdtc32.exe 3256 wmpdtc32.exe 3256 wmpdtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3624 wrote to memory of 1800 3624 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 1800 wrote to memory of 2752 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 89 PID 1800 wrote to memory of 2752 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 89 PID 1800 wrote to memory of 2752 1800 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 89 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 2752 wrote to memory of 4260 2752 wmpdtc32.exe 90 PID 4260 wrote to memory of 4392 4260 wmpdtc32.exe 91 PID 4260 wrote to memory of 4392 4260 wmpdtc32.exe 91 PID 4260 wrote to memory of 4392 4260 wmpdtc32.exe 91 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4392 wrote to memory of 4960 4392 wmpdtc32.exe 92 PID 4960 wrote to memory of 3184 4960 wmpdtc32.exe 95 PID 4960 wrote to memory of 3184 4960 wmpdtc32.exe 95 PID 4960 wrote to memory of 3184 4960 wmpdtc32.exe 95 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 3184 wrote to memory of 4852 3184 wmpdtc32.exe 96 PID 4852 wrote to memory of 1064 4852 wmpdtc32.exe 98 PID 4852 wrote to memory of 1064 4852 wmpdtc32.exe 98 PID 4852 wrote to memory of 1064 4852 wmpdtc32.exe 98 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 1064 wrote to memory of 3796 1064 wmpdtc32.exe 99 PID 3796 wrote to memory of 4348 3796 wmpdtc32.exe 101 PID 3796 wrote to memory of 4348 3796 wmpdtc32.exe 101 PID 3796 wrote to memory of 4348 3796 wmpdtc32.exe 101 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 4348 wrote to memory of 1320 4348 wmpdtc32.exe 102 PID 1320 wrote to memory of 3512 1320 wmpdtc32.exe 103 PID 1320 wrote to memory of 3512 1320 wmpdtc32.exe 103 PID 1320 wrote to memory of 3512 1320 wmpdtc32.exe 103 PID 3512 wrote to memory of 4716 3512 wmpdtc32.exe 104 PID 3512 wrote to memory of 4716 3512 wmpdtc32.exe 104 PID 3512 wrote to memory of 4716 3512 wmpdtc32.exe 104 PID 3512 wrote to memory of 4716 3512 wmpdtc32.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4716 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1484 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4400 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5036 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3648 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2936 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3316 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4440 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4564 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2272 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1352 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1524 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4552 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe30⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD5f9038f1859b2e5d7f4a2d9a1aafb4f3e
SHA152ef34a49bfb8a7a0149fe24915daacd2b229d48
SHA2565302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
SHA512f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af