Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 02:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe
-
Size
148KB
-
MD5
2aabe1a862e121a8f81b2e68d1118d40
-
SHA1
970d04915a2f7faca229caf94087af211c88c473
-
SHA256
7252296ab2fda4a1f4bbffd9a273990c7e99bd26dae7ddf95cf85f7f3ef5e9be
-
SHA512
f7601c3ff25cc548e1378ab09967e856f8f65eb5a313bb11b5254ee9f2f4352032c0d52aed2072cd9a346c1fd1996472ed5d2fd4ffd5f595417f0582069cb12d
-
SSDEEP
3072:yQ9zPtsX9N+qiPQ+utG9pBuU3xmgZjp832Gl7i7hb8J6Rl/T:y9XZcWGxuUBmgVpI3diG6P
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation wnptv4.exe -
Deletes itself 1 IoCs
pid Process 952 wnptv4.exe -
Executes dropped EXE 52 IoCs
pid Process 620 wnptv4.exe 952 wnptv4.exe 516 wnptv4.exe 536 wnptv4.exe 4944 wnptv4.exe 4836 wnptv4.exe 5012 wnptv4.exe 4612 wnptv4.exe 2552 wnptv4.exe 3012 wnptv4.exe 1548 wnptv4.exe 3704 wnptv4.exe 1220 wnptv4.exe 1148 wnptv4.exe 4964 wnptv4.exe 2760 wnptv4.exe 3540 wnptv4.exe 2560 wnptv4.exe 2320 wnptv4.exe 820 wnptv4.exe 4312 wnptv4.exe 5112 wnptv4.exe 1820 wnptv4.exe 4008 wnptv4.exe 1552 wnptv4.exe 4388 wnptv4.exe 380 wnptv4.exe 524 wnptv4.exe 4808 wnptv4.exe 332 wnptv4.exe 2268 wnptv4.exe 4328 wnptv4.exe 3932 wnptv4.exe 3032 wnptv4.exe 2172 wnptv4.exe 4528 wnptv4.exe 2968 wnptv4.exe 4048 wnptv4.exe 4720 wnptv4.exe 4700 wnptv4.exe 4540 wnptv4.exe 1168 wnptv4.exe 4184 wnptv4.exe 4988 wnptv4.exe 2520 wnptv4.exe 5032 wnptv4.exe 4596 wnptv4.exe 4520 wnptv4.exe 5116 wnptv4.exe 2244 wnptv4.exe 1952 wnptv4.exe 1532 wnptv4.exe -
resource yara_rule behavioral2/memory/2788-0-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2788-2-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2788-3-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2788-4-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2788-38-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/952-43-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/952-44-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/952-45-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/952-47-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/536-51-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/536-52-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/536-54-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4836-61-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4612-68-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3012-75-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3704-83-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1148-90-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2760-97-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2560-105-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/820-112-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/5112-120-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4008-129-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4388-137-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/524-145-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/332-153-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4328-161-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3032-165-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3032-170-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4528-179-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4048-187-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4700-192-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4700-197-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1168-205-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4988-213-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/5032-220-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4520-226-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2244-230-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2244-233-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 54 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptv4.exe -
Drops file in System32 directory 52 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnptv4.exe 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File opened for modification C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe File created C:\Windows\SysWOW64\wnptv4.exe wnptv4.exe -
Suspicious use of SetThreadContext 27 IoCs
description pid Process procid_target PID 3700 set thread context of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 620 set thread context of 952 620 wnptv4.exe 86 PID 516 set thread context of 536 516 wnptv4.exe 88 PID 4944 set thread context of 4836 4944 wnptv4.exe 90 PID 5012 set thread context of 4612 5012 wnptv4.exe 92 PID 2552 set thread context of 3012 2552 wnptv4.exe 96 PID 1548 set thread context of 3704 1548 wnptv4.exe 98 PID 1220 set thread context of 1148 1220 wnptv4.exe 100 PID 4964 set thread context of 2760 4964 wnptv4.exe 103 PID 3540 set thread context of 2560 3540 wnptv4.exe 105 PID 2320 set thread context of 820 2320 wnptv4.exe 107 PID 4312 set thread context of 5112 4312 wnptv4.exe 109 PID 1820 set thread context of 4008 1820 wnptv4.exe 111 PID 1552 set thread context of 4388 1552 wnptv4.exe 113 PID 380 set thread context of 524 380 wnptv4.exe 115 PID 4808 set thread context of 332 4808 wnptv4.exe 117 PID 2268 set thread context of 4328 2268 wnptv4.exe 119 PID 3932 set thread context of 3032 3932 wnptv4.exe 121 PID 2172 set thread context of 4528 2172 wnptv4.exe 123 PID 2968 set thread context of 4048 2968 wnptv4.exe 125 PID 4720 set thread context of 4700 4720 wnptv4.exe 127 PID 4540 set thread context of 1168 4540 wnptv4.exe 129 PID 4184 set thread context of 4988 4184 wnptv4.exe 131 PID 2520 set thread context of 5032 2520 wnptv4.exe 133 PID 4596 set thread context of 4520 4596 wnptv4.exe 135 PID 5116 set thread context of 2244 5116 wnptv4.exe 137 PID 1952 set thread context of 1532 1952 wnptv4.exe 139 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptv4.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2788 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 2788 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 952 wnptv4.exe 952 wnptv4.exe 536 wnptv4.exe 536 wnptv4.exe 4836 wnptv4.exe 4836 wnptv4.exe 4612 wnptv4.exe 4612 wnptv4.exe 3012 wnptv4.exe 3012 wnptv4.exe 3704 wnptv4.exe 3704 wnptv4.exe 1148 wnptv4.exe 1148 wnptv4.exe 2760 wnptv4.exe 2760 wnptv4.exe 2560 wnptv4.exe 2560 wnptv4.exe 820 wnptv4.exe 820 wnptv4.exe 5112 wnptv4.exe 5112 wnptv4.exe 4008 wnptv4.exe 4008 wnptv4.exe 4388 wnptv4.exe 4388 wnptv4.exe 524 wnptv4.exe 524 wnptv4.exe 332 wnptv4.exe 332 wnptv4.exe 4328 wnptv4.exe 4328 wnptv4.exe 3032 wnptv4.exe 3032 wnptv4.exe 4528 wnptv4.exe 4528 wnptv4.exe 4048 wnptv4.exe 4048 wnptv4.exe 4700 wnptv4.exe 4700 wnptv4.exe 1168 wnptv4.exe 1168 wnptv4.exe 4988 wnptv4.exe 4988 wnptv4.exe 5032 wnptv4.exe 5032 wnptv4.exe 4520 wnptv4.exe 4520 wnptv4.exe 2244 wnptv4.exe 2244 wnptv4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 3700 wrote to memory of 2788 3700 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 84 PID 2788 wrote to memory of 620 2788 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 85 PID 2788 wrote to memory of 620 2788 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 85 PID 2788 wrote to memory of 620 2788 2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe 85 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 620 wrote to memory of 952 620 wnptv4.exe 86 PID 952 wrote to memory of 516 952 wnptv4.exe 87 PID 952 wrote to memory of 516 952 wnptv4.exe 87 PID 952 wrote to memory of 516 952 wnptv4.exe 87 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 516 wrote to memory of 536 516 wnptv4.exe 88 PID 536 wrote to memory of 4944 536 wnptv4.exe 89 PID 536 wrote to memory of 4944 536 wnptv4.exe 89 PID 536 wrote to memory of 4944 536 wnptv4.exe 89 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4944 wrote to memory of 4836 4944 wnptv4.exe 90 PID 4836 wrote to memory of 5012 4836 wnptv4.exe 91 PID 4836 wrote to memory of 5012 4836 wnptv4.exe 91 PID 4836 wrote to memory of 5012 4836 wnptv4.exe 91 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 5012 wrote to memory of 4612 5012 wnptv4.exe 92 PID 4612 wrote to memory of 2552 4612 wnptv4.exe 95 PID 4612 wrote to memory of 2552 4612 wnptv4.exe 95 PID 4612 wrote to memory of 2552 4612 wnptv4.exe 95 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 2552 wrote to memory of 3012 2552 wnptv4.exe 96 PID 3012 wrote to memory of 1548 3012 wnptv4.exe 97 PID 3012 wrote to memory of 1548 3012 wnptv4.exe 97 PID 3012 wrote to memory of 1548 3012 wnptv4.exe 97 PID 1548 wrote to memory of 3704 1548 wnptv4.exe 98 PID 1548 wrote to memory of 3704 1548 wnptv4.exe 98 PID 1548 wrote to memory of 3704 1548 wnptv4.exe 98 PID 1548 wrote to memory of 3704 1548 wnptv4.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2aabe1a862e121a8f81b2e68d1118d40_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Users\Admin\AppData\Local\Temp\2AABE1~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Users\Admin\AppData\Local\Temp\2AABE1~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3704 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1220 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1148 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4964 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3540 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2560 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2320 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:820 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4312 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5112 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1820 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4008 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1552 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4388 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:380 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:524 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4808 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:332 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2268 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3932 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3032 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2172 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4528 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2968 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4048 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4720 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4700 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4540 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1168 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4184 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4988 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2520 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5032 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4596 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4520 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5116 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2244 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1952 -
C:\Windows\SysWOW64\wnptv4.exe"C:\Windows\system32\wnptv4.exe" C:\Windows\SysWOW64\wnptv4.exe54⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD52aabe1a862e121a8f81b2e68d1118d40
SHA1970d04915a2f7faca229caf94087af211c88c473
SHA2567252296ab2fda4a1f4bbffd9a273990c7e99bd26dae7ddf95cf85f7f3ef5e9be
SHA512f7601c3ff25cc548e1378ab09967e856f8f65eb5a313bb11b5254ee9f2f4352032c0d52aed2072cd9a346c1fd1996472ed5d2fd4ffd5f595417f0582069cb12d