Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe
-
Size
194KB
-
MD5
05e35cde9615f997867818cb6ae5b38f
-
SHA1
38726431f39e47c168ff014b7c04e0a00ebf2b85
-
SHA256
cb135da1bc06b5cf792c921e0b2cbf39d016eca0e718d1ac3a502c90ee3a9776
-
SHA512
6f3ae7b9a49a96a80cd49314f2dfa5c2c98a0ba678fc35952c1516ab3b0e12f6199fb55051fdcc8ef8bc04b4ba546499ce5e409487251ee495a57a6d12abea87
-
SSDEEP
6144:Ifw998aN22pAouklidA0zHH6uQFWI4Q/WXc:aw9UKFlcAEH614ED
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
wmpxr1.exepid process 2040 wmpxr1.exe -
Executes dropped EXE 57 IoCs
Processes:
wmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exepid process 2040 wmpxr1.exe 2484 wmpxr1.exe 2848 wmpxr1.exe 2316 wmpxr1.exe 1704 wmpxr1.exe 1944 wmpxr1.exe 1380 wmpxr1.exe 2276 wmpxr1.exe 1792 wmpxr1.exe 2216 wmpxr1.exe 1592 wmpxr1.exe 2436 wmpxr1.exe 2104 wmpxr1.exe 2972 wmpxr1.exe 2804 wmpxr1.exe 2816 wmpxr1.exe 2796 wmpxr1.exe 1472 wmpxr1.exe 1552 wmpxr1.exe 1920 wmpxr1.exe 888 wmpxr1.exe 2872 wmpxr1.exe 1000 wmpxr1.exe 2120 wmpxr1.exe 1640 wmpxr1.exe 2416 wmpxr1.exe 2612 wmpxr1.exe 1396 wmpxr1.exe 676 wmpxr1.exe 472 wmpxr1.exe 2788 wmpxr1.exe 2276 wmpxr1.exe 2352 wmpxr1.exe 1708 wmpxr1.exe 2580 wmpxr1.exe 2700 wmpxr1.exe 3008 wmpxr1.exe 1808 wmpxr1.exe 2836 wmpxr1.exe 1244 wmpxr1.exe 2388 wmpxr1.exe 852 wmpxr1.exe 856 wmpxr1.exe 1948 wmpxr1.exe 1812 wmpxr1.exe 2300 wmpxr1.exe 2888 wmpxr1.exe 1700 wmpxr1.exe 2960 wmpxr1.exe 2812 wmpxr1.exe 1584 wmpxr1.exe 2608 wmpxr1.exe 2356 wmpxr1.exe 2796 wmpxr1.exe 1856 wmpxr1.exe 2896 wmpxr1.exe 2380 wmpxr1.exe -
Loads dropped DLL 64 IoCs
Processes:
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exepid process 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe 2040 wmpxr1.exe 2040 wmpxr1.exe 2484 wmpxr1.exe 2484 wmpxr1.exe 2848 wmpxr1.exe 2848 wmpxr1.exe 2316 wmpxr1.exe 2316 wmpxr1.exe 1704 wmpxr1.exe 1704 wmpxr1.exe 1944 wmpxr1.exe 1944 wmpxr1.exe 1380 wmpxr1.exe 1380 wmpxr1.exe 2276 wmpxr1.exe 2276 wmpxr1.exe 1792 wmpxr1.exe 1792 wmpxr1.exe 2216 wmpxr1.exe 2216 wmpxr1.exe 1592 wmpxr1.exe 1592 wmpxr1.exe 2436 wmpxr1.exe 2436 wmpxr1.exe 2104 wmpxr1.exe 2104 wmpxr1.exe 2972 wmpxr1.exe 2972 wmpxr1.exe 2804 wmpxr1.exe 2804 wmpxr1.exe 2816 wmpxr1.exe 2816 wmpxr1.exe 2796 wmpxr1.exe 2796 wmpxr1.exe 1472 wmpxr1.exe 1472 wmpxr1.exe 1552 wmpxr1.exe 1552 wmpxr1.exe 1920 wmpxr1.exe 1920 wmpxr1.exe 888 wmpxr1.exe 888 wmpxr1.exe 2872 wmpxr1.exe 2872 wmpxr1.exe 1000 wmpxr1.exe 1000 wmpxr1.exe 2120 wmpxr1.exe 2120 wmpxr1.exe 1640 wmpxr1.exe 1640 wmpxr1.exe 2416 wmpxr1.exe 2416 wmpxr1.exe 2612 wmpxr1.exe 2612 wmpxr1.exe 1396 wmpxr1.exe 1396 wmpxr1.exe 676 wmpxr1.exe 676 wmpxr1.exe 472 wmpxr1.exe 472 wmpxr1.exe 2788 wmpxr1.exe 2788 wmpxr1.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exe05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpxr1.exe -
Drops file in System32 directory 64 IoCs
Processes:
wmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exe05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File opened for modification C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe File created C:\Windows\SysWOW64\wmpxr1.exe wmpxr1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 57 IoCs
Processes:
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exepid process 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe 2040 wmpxr1.exe 2484 wmpxr1.exe 2848 wmpxr1.exe 2316 wmpxr1.exe 1704 wmpxr1.exe 1944 wmpxr1.exe 1380 wmpxr1.exe 2276 wmpxr1.exe 1792 wmpxr1.exe 2216 wmpxr1.exe 1592 wmpxr1.exe 2436 wmpxr1.exe 2104 wmpxr1.exe 2972 wmpxr1.exe 2804 wmpxr1.exe 2816 wmpxr1.exe 2796 wmpxr1.exe 1472 wmpxr1.exe 1552 wmpxr1.exe 1920 wmpxr1.exe 888 wmpxr1.exe 2872 wmpxr1.exe 1000 wmpxr1.exe 2120 wmpxr1.exe 1640 wmpxr1.exe 2416 wmpxr1.exe 2612 wmpxr1.exe 1396 wmpxr1.exe 676 wmpxr1.exe 472 wmpxr1.exe 2788 wmpxr1.exe 2276 wmpxr1.exe 1708 wmpxr1.exe 2580 wmpxr1.exe 2700 wmpxr1.exe 3008 wmpxr1.exe 1808 wmpxr1.exe 2836 wmpxr1.exe 1244 wmpxr1.exe 2388 wmpxr1.exe 852 wmpxr1.exe 856 wmpxr1.exe 1948 wmpxr1.exe 1812 wmpxr1.exe 2300 wmpxr1.exe 2888 wmpxr1.exe 1700 wmpxr1.exe 2960 wmpxr1.exe 2812 wmpxr1.exe 1584 wmpxr1.exe 2608 wmpxr1.exe 2356 wmpxr1.exe 2796 wmpxr1.exe 1856 wmpxr1.exe 2896 wmpxr1.exe 2380 wmpxr1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exepid process 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe 2040 wmpxr1.exe 2484 wmpxr1.exe 2848 wmpxr1.exe 2316 wmpxr1.exe 1704 wmpxr1.exe 1944 wmpxr1.exe 1380 wmpxr1.exe 2276 wmpxr1.exe 1792 wmpxr1.exe 2216 wmpxr1.exe 1592 wmpxr1.exe 2436 wmpxr1.exe 2104 wmpxr1.exe 2972 wmpxr1.exe 2804 wmpxr1.exe 2816 wmpxr1.exe 2796 wmpxr1.exe 1472 wmpxr1.exe 1552 wmpxr1.exe 1920 wmpxr1.exe 888 wmpxr1.exe 2872 wmpxr1.exe 1000 wmpxr1.exe 2120 wmpxr1.exe 1640 wmpxr1.exe 2416 wmpxr1.exe 2612 wmpxr1.exe 1396 wmpxr1.exe 676 wmpxr1.exe 472 wmpxr1.exe 2788 wmpxr1.exe 2276 wmpxr1.exe 1708 wmpxr1.exe 2580 wmpxr1.exe 2700 wmpxr1.exe 3008 wmpxr1.exe 1808 wmpxr1.exe 2836 wmpxr1.exe 1244 wmpxr1.exe 2388 wmpxr1.exe 852 wmpxr1.exe 856 wmpxr1.exe 1948 wmpxr1.exe 1812 wmpxr1.exe 2300 wmpxr1.exe 2888 wmpxr1.exe 1700 wmpxr1.exe 2960 wmpxr1.exe 2812 wmpxr1.exe 1584 wmpxr1.exe 2608 wmpxr1.exe 2356 wmpxr1.exe 2796 wmpxr1.exe 1856 wmpxr1.exe 2896 wmpxr1.exe 2380 wmpxr1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exewmpxr1.exedescription pid process target process PID 664 wrote to memory of 2040 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe wmpxr1.exe PID 664 wrote to memory of 2040 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe wmpxr1.exe PID 664 wrote to memory of 2040 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe wmpxr1.exe PID 664 wrote to memory of 2040 664 05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe wmpxr1.exe PID 2040 wrote to memory of 2484 2040 wmpxr1.exe wmpxr1.exe PID 2040 wrote to memory of 2484 2040 wmpxr1.exe wmpxr1.exe PID 2040 wrote to memory of 2484 2040 wmpxr1.exe wmpxr1.exe PID 2040 wrote to memory of 2484 2040 wmpxr1.exe wmpxr1.exe PID 2484 wrote to memory of 2848 2484 wmpxr1.exe wmpxr1.exe PID 2484 wrote to memory of 2848 2484 wmpxr1.exe wmpxr1.exe PID 2484 wrote to memory of 2848 2484 wmpxr1.exe wmpxr1.exe PID 2484 wrote to memory of 2848 2484 wmpxr1.exe wmpxr1.exe PID 2848 wrote to memory of 2316 2848 wmpxr1.exe wmpxr1.exe PID 2848 wrote to memory of 2316 2848 wmpxr1.exe wmpxr1.exe PID 2848 wrote to memory of 2316 2848 wmpxr1.exe wmpxr1.exe PID 2848 wrote to memory of 2316 2848 wmpxr1.exe wmpxr1.exe PID 2316 wrote to memory of 1704 2316 wmpxr1.exe wmpxr1.exe PID 2316 wrote to memory of 1704 2316 wmpxr1.exe wmpxr1.exe PID 2316 wrote to memory of 1704 2316 wmpxr1.exe wmpxr1.exe PID 2316 wrote to memory of 1704 2316 wmpxr1.exe wmpxr1.exe PID 1704 wrote to memory of 1944 1704 wmpxr1.exe wmpxr1.exe PID 1704 wrote to memory of 1944 1704 wmpxr1.exe wmpxr1.exe PID 1704 wrote to memory of 1944 1704 wmpxr1.exe wmpxr1.exe PID 1704 wrote to memory of 1944 1704 wmpxr1.exe wmpxr1.exe PID 1944 wrote to memory of 1380 1944 wmpxr1.exe wmpxr1.exe PID 1944 wrote to memory of 1380 1944 wmpxr1.exe wmpxr1.exe PID 1944 wrote to memory of 1380 1944 wmpxr1.exe wmpxr1.exe PID 1944 wrote to memory of 1380 1944 wmpxr1.exe wmpxr1.exe PID 1380 wrote to memory of 2276 1380 wmpxr1.exe wmpxr1.exe PID 1380 wrote to memory of 2276 1380 wmpxr1.exe wmpxr1.exe PID 1380 wrote to memory of 2276 1380 wmpxr1.exe wmpxr1.exe PID 1380 wrote to memory of 2276 1380 wmpxr1.exe wmpxr1.exe PID 2276 wrote to memory of 1792 2276 wmpxr1.exe wmpxr1.exe PID 2276 wrote to memory of 1792 2276 wmpxr1.exe wmpxr1.exe PID 2276 wrote to memory of 1792 2276 wmpxr1.exe wmpxr1.exe PID 2276 wrote to memory of 1792 2276 wmpxr1.exe wmpxr1.exe PID 1792 wrote to memory of 2216 1792 wmpxr1.exe wmpxr1.exe PID 1792 wrote to memory of 2216 1792 wmpxr1.exe wmpxr1.exe PID 1792 wrote to memory of 2216 1792 wmpxr1.exe wmpxr1.exe PID 1792 wrote to memory of 2216 1792 wmpxr1.exe wmpxr1.exe PID 2216 wrote to memory of 1592 2216 wmpxr1.exe wmpxr1.exe PID 2216 wrote to memory of 1592 2216 wmpxr1.exe wmpxr1.exe PID 2216 wrote to memory of 1592 2216 wmpxr1.exe wmpxr1.exe PID 2216 wrote to memory of 1592 2216 wmpxr1.exe wmpxr1.exe PID 1592 wrote to memory of 2436 1592 wmpxr1.exe wmpxr1.exe PID 1592 wrote to memory of 2436 1592 wmpxr1.exe wmpxr1.exe PID 1592 wrote to memory of 2436 1592 wmpxr1.exe wmpxr1.exe PID 1592 wrote to memory of 2436 1592 wmpxr1.exe wmpxr1.exe PID 2436 wrote to memory of 2104 2436 wmpxr1.exe wmpxr1.exe PID 2436 wrote to memory of 2104 2436 wmpxr1.exe wmpxr1.exe PID 2436 wrote to memory of 2104 2436 wmpxr1.exe wmpxr1.exe PID 2436 wrote to memory of 2104 2436 wmpxr1.exe wmpxr1.exe PID 2104 wrote to memory of 2972 2104 wmpxr1.exe wmpxr1.exe PID 2104 wrote to memory of 2972 2104 wmpxr1.exe wmpxr1.exe PID 2104 wrote to memory of 2972 2104 wmpxr1.exe wmpxr1.exe PID 2104 wrote to memory of 2972 2104 wmpxr1.exe wmpxr1.exe PID 2972 wrote to memory of 2804 2972 wmpxr1.exe wmpxr1.exe PID 2972 wrote to memory of 2804 2972 wmpxr1.exe wmpxr1.exe PID 2972 wrote to memory of 2804 2972 wmpxr1.exe wmpxr1.exe PID 2972 wrote to memory of 2804 2972 wmpxr1.exe wmpxr1.exe PID 2804 wrote to memory of 2816 2804 wmpxr1.exe wmpxr1.exe PID 2804 wrote to memory of 2816 2804 wmpxr1.exe wmpxr1.exe PID 2804 wrote to memory of 2816 2804 wmpxr1.exe wmpxr1.exe PID 2804 wrote to memory of 2816 2804 wmpxr1.exe wmpxr1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05e35cde9615f997867818cb6ae5b38f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Users\Admin\AppData\Local\Temp\05E35C~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2816 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1472 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:888 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2872 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1000 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2416 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2612 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:472 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2788 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2352 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2580 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3008 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1808 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2836 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1244 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:852 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:856 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1948 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1812 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2300 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1700 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe50⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe53⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2608 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe54⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2356 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe55⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2796 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe57⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2896 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\wmpxr1.exe"C:\Windows\system32\wmpxr1.exe" C:\Windows\SysWOW64\wmpxr1.exe59⤵PID:2948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
194KB
MD505e35cde9615f997867818cb6ae5b38f
SHA138726431f39e47c168ff014b7c04e0a00ebf2b85
SHA256cb135da1bc06b5cf792c921e0b2cbf39d016eca0e718d1ac3a502c90ee3a9776
SHA5126f3ae7b9a49a96a80cd49314f2dfa5c2c98a0ba678fc35952c1516ab3b0e12f6199fb55051fdcc8ef8bc04b4ba546499ce5e409487251ee495a57a6d12abea87