Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 07:59
Static task
static1
Behavioral task
behavioral1
Sample
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe
-
Size
158KB
-
MD5
05a01aca9aa8167b69104f61974392c4
-
SHA1
e9e817e631cc6e9081ed6e9574ce66896bd5466b
-
SHA256
bb90cebc57c6254ee88868ea0635b54e27e0b4076087db0d9db6fe712da2ce00
-
SHA512
fdc2942ab05b8d58aea2089d25887679038a1a3a85249db412167361c636e1c8799f7eb787193b3b451f960c41f33a3cd70ae921171b56959d8be037d2595ccb
-
SSDEEP
3072:A3iOPDhkZHdMGKhkXaW+/8z4SmwIGkr/VP4qFksnliFvt8AC+R:EPeSSxtKwxkr/p4qiIix
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
wnpkm2.exepid process 2648 wnpkm2.exe -
Executes dropped EXE 38 IoCs
Processes:
wnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exepid process 2876 wnpkm2.exe 2648 wnpkm2.exe 2124 wnpkm2.exe 520 wnpkm2.exe 2860 wnpkm2.exe 2160 wnpkm2.exe 1456 wnpkm2.exe 2680 wnpkm2.exe 1732 wnpkm2.exe 3052 wnpkm2.exe 1284 wnpkm2.exe 1028 wnpkm2.exe 1088 wnpkm2.exe 2908 wnpkm2.exe 1912 wnpkm2.exe 2000 wnpkm2.exe 1168 wnpkm2.exe 2584 wnpkm2.exe 2504 wnpkm2.exe 2524 wnpkm2.exe 2168 wnpkm2.exe 1512 wnpkm2.exe 2964 wnpkm2.exe 2384 wnpkm2.exe 1340 wnpkm2.exe 2700 wnpkm2.exe 1732 wnpkm2.exe 2364 wnpkm2.exe 984 wnpkm2.exe 2300 wnpkm2.exe 2308 wnpkm2.exe 3004 wnpkm2.exe 2916 wnpkm2.exe 2604 wnpkm2.exe 772 wnpkm2.exe 2652 wnpkm2.exe 2688 wnpkm2.exe 2472 wnpkm2.exe -
Loads dropped DLL 19 IoCs
Processes:
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exepid process 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 2648 wnpkm2.exe 520 wnpkm2.exe 2160 wnpkm2.exe 2680 wnpkm2.exe 3052 wnpkm2.exe 1028 wnpkm2.exe 2908 wnpkm2.exe 2000 wnpkm2.exe 2584 wnpkm2.exe 2524 wnpkm2.exe 1512 wnpkm2.exe 2384 wnpkm2.exe 2700 wnpkm2.exe 2364 wnpkm2.exe 2300 wnpkm2.exe 3004 wnpkm2.exe 2604 wnpkm2.exe 2652 wnpkm2.exe -
Processes:
resource yara_rule behavioral1/memory/3032-7-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-8-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-9-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-6-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-3-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3032-17-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2648-30-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2648-29-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2648-28-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2648-36-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/520-47-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/520-45-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/520-46-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/520-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2160-61-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2160-63-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2160-62-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2160-68-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2680-79-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2680-81-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3052-94-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3052-98-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1028-109-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1028-116-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2908-126-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2908-132-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2000-143-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2000-149-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2584-160-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2584-164-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2524-176-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2524-181-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1512-192-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1512-198-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2384-209-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2384-214-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2700-225-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2700-231-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2364-242-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2364-247-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2300-258-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2300-263-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3004-273-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3004-279-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2604-290-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2604-294-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2652-303-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2652-307-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2472-317-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2472-320-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2168-330-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2168-333-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1964-343-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1964-346-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2516-355-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 40 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exe05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe -
Drops file in System32 directory 40 IoCs
Processes:
wnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exe05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exedescription ioc process File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpkm2.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe -
Suspicious use of SetThreadContext 20 IoCs
Processes:
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exedescription pid process target process PID 2868 set thread context of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2876 set thread context of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2124 set thread context of 520 2124 wnpkm2.exe wnpkm2.exe PID 2860 set thread context of 2160 2860 wnpkm2.exe wnpkm2.exe PID 1456 set thread context of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1732 set thread context of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1284 set thread context of 1028 1284 wnpkm2.exe wnpkm2.exe PID 1088 set thread context of 2908 1088 wnpkm2.exe wnpkm2.exe PID 1912 set thread context of 2000 1912 wnpkm2.exe wnpkm2.exe PID 1168 set thread context of 2584 1168 wnpkm2.exe wnpkm2.exe PID 2504 set thread context of 2524 2504 wnpkm2.exe wnpkm2.exe PID 2168 set thread context of 1512 2168 wnpkm2.exe wnpkm2.exe PID 2964 set thread context of 2384 2964 wnpkm2.exe wnpkm2.exe PID 1340 set thread context of 2700 1340 wnpkm2.exe wnpkm2.exe PID 1732 set thread context of 2364 1732 wnpkm2.exe wnpkm2.exe PID 984 set thread context of 2300 984 wnpkm2.exe wnpkm2.exe PID 2308 set thread context of 3004 2308 wnpkm2.exe wnpkm2.exe PID 2916 set thread context of 2604 2916 wnpkm2.exe wnpkm2.exe PID 772 set thread context of 2652 772 wnpkm2.exe wnpkm2.exe PID 2688 set thread context of 2472 2688 wnpkm2.exe wnpkm2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exepid process 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 2648 wnpkm2.exe 520 wnpkm2.exe 2160 wnpkm2.exe 2680 wnpkm2.exe 3052 wnpkm2.exe 1028 wnpkm2.exe 2908 wnpkm2.exe 2000 wnpkm2.exe 2584 wnpkm2.exe 2524 wnpkm2.exe 1512 wnpkm2.exe 2384 wnpkm2.exe 2700 wnpkm2.exe 2364 wnpkm2.exe 2300 wnpkm2.exe 3004 wnpkm2.exe 2604 wnpkm2.exe 2652 wnpkm2.exe 2472 wnpkm2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exewnpkm2.exedescription pid process target process PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 2868 wrote to memory of 3032 2868 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe PID 3032 wrote to memory of 2876 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe wnpkm2.exe PID 3032 wrote to memory of 2876 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe wnpkm2.exe PID 3032 wrote to memory of 2876 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe wnpkm2.exe PID 3032 wrote to memory of 2876 3032 05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2876 wrote to memory of 2648 2876 wnpkm2.exe wnpkm2.exe PID 2648 wrote to memory of 2124 2648 wnpkm2.exe wnpkm2.exe PID 2648 wrote to memory of 2124 2648 wnpkm2.exe wnpkm2.exe PID 2648 wrote to memory of 2124 2648 wnpkm2.exe wnpkm2.exe PID 2648 wrote to memory of 2124 2648 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 2124 wrote to memory of 520 2124 wnpkm2.exe wnpkm2.exe PID 520 wrote to memory of 2860 520 wnpkm2.exe wnpkm2.exe PID 520 wrote to memory of 2860 520 wnpkm2.exe wnpkm2.exe PID 520 wrote to memory of 2860 520 wnpkm2.exe wnpkm2.exe PID 520 wrote to memory of 2860 520 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2860 wrote to memory of 2160 2860 wnpkm2.exe wnpkm2.exe PID 2160 wrote to memory of 1456 2160 wnpkm2.exe wnpkm2.exe PID 2160 wrote to memory of 1456 2160 wnpkm2.exe wnpkm2.exe PID 2160 wrote to memory of 1456 2160 wnpkm2.exe wnpkm2.exe PID 2160 wrote to memory of 1456 2160 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 1456 wrote to memory of 2680 1456 wnpkm2.exe wnpkm2.exe PID 2680 wrote to memory of 1732 2680 wnpkm2.exe wnpkm2.exe PID 2680 wrote to memory of 1732 2680 wnpkm2.exe wnpkm2.exe PID 2680 wrote to memory of 1732 2680 wnpkm2.exe wnpkm2.exe PID 2680 wrote to memory of 1732 2680 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 1732 wrote to memory of 3052 1732 wnpkm2.exe wnpkm2.exe PID 3052 wrote to memory of 1284 3052 wnpkm2.exe wnpkm2.exe PID 3052 wrote to memory of 1284 3052 wnpkm2.exe wnpkm2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05a01aca9aa8167b69104f61974392c4_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Users\Admin\AppData\Local\Temp\05A01A~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Users\Admin\AppData\Local\Temp\05A01A~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1284 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1028 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1088 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2908 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1912 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1168 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2584 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2504 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2168 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2964 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2384 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1340 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1732 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:984 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2300 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2308 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2916 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:772 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2652 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2688 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2472 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe41⤵PID:2972
-
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe42⤵PID:2168
-
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe43⤵PID:108
-
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe44⤵PID:1964
-
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe45⤵PID:1948
-
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe46⤵PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
158KB
MD505a01aca9aa8167b69104f61974392c4
SHA1e9e817e631cc6e9081ed6e9574ce66896bd5466b
SHA256bb90cebc57c6254ee88868ea0635b54e27e0b4076087db0d9db6fe712da2ce00
SHA512fdc2942ab05b8d58aea2089d25887679038a1a3a85249db412167361c636e1c8799f7eb787193b3b451f960c41f33a3cd70ae921171b56959d8be037d2595ccb