Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe
-
Size
155KB
-
MD5
a0f1cd20775f9e1ed0b40fb9122f529f
-
SHA1
639f8cd398fea2b12373c8ee4db5c3c6d7185517
-
SHA256
f0279fe1b492cb8e9fe74fa7cedbf6de3adb6eb8106cfbc52cf4b1d4cdf27d96
-
SHA512
483ab2ba34c301dad32e112813c52983362f103dd22fe7821184beab26f75854d2f86dcf436f93a23e8bd0e78b00509dac5dcf02ca81c1b698e5d10bef302ddf
-
SSDEEP
3072:9a+huKQDjjM78IWjdJWZdSleKY5MG0inih23hGB2odHwQxswNoqMbFNN:9ZuKQDLIWJS+49vnXhGB2C3swUx
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2728 wnpkm1.exe -
Executes dropped EXE 46 IoCs
pid Process 2824 wnpkm1.exe 2728 wnpkm1.exe 2560 wnpkm1.exe 1632 wnpkm1.exe 2296 wnpkm1.exe 2504 wnpkm1.exe 2924 wnpkm1.exe 2992 wnpkm1.exe 2760 wnpkm1.exe 1276 wnpkm1.exe 3012 wnpkm1.exe 392 wnpkm1.exe 472 wnpkm1.exe 2012 wnpkm1.exe 2424 wnpkm1.exe 1688 wnpkm1.exe 2264 wnpkm1.exe 2376 wnpkm1.exe 2700 wnpkm1.exe 2704 wnpkm1.exe 808 wnpkm1.exe 1744 wnpkm1.exe 2932 wnpkm1.exe 2284 wnpkm1.exe 3016 wnpkm1.exe 2548 wnpkm1.exe 1704 wnpkm1.exe 1608 wnpkm1.exe 2248 wnpkm1.exe 1736 wnpkm1.exe 1484 wnpkm1.exe 2936 wnpkm1.exe 1576 wnpkm1.exe 2324 wnpkm1.exe 2716 wnpkm1.exe 3048 wnpkm1.exe 2960 wnpkm1.exe 2116 wnpkm1.exe 2732 wnpkm1.exe 1708 wnpkm1.exe 2904 wnpkm1.exe 2860 wnpkm1.exe 3024 wnpkm1.exe 1856 wnpkm1.exe 1924 wnpkm1.exe 2760 wnpkm1.exe -
Loads dropped DLL 23 IoCs
pid Process 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 2728 wnpkm1.exe 1632 wnpkm1.exe 2504 wnpkm1.exe 2992 wnpkm1.exe 1276 wnpkm1.exe 392 wnpkm1.exe 2012 wnpkm1.exe 1688 wnpkm1.exe 2376 wnpkm1.exe 2704 wnpkm1.exe 1744 wnpkm1.exe 2284 wnpkm1.exe 2548 wnpkm1.exe 1608 wnpkm1.exe 1736 wnpkm1.exe 2936 wnpkm1.exe 2324 wnpkm1.exe 3048 wnpkm1.exe 2116 wnpkm1.exe 1708 wnpkm1.exe 2860 wnpkm1.exe 1856 wnpkm1.exe -
resource yara_rule behavioral1/memory/1056-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-9-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-10-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-11-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-8-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-6-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1056-19-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2728-30-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2728-31-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2728-32-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2728-37-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1632-47-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1632-49-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1632-48-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1632-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2504-63-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2504-62-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2504-64-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2504-69-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2992-80-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2992-83-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1276-95-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1276-100-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/392-111-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/392-116-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2012-127-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2012-132-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1688-143-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1688-148-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2376-158-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2376-164-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2704-175-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2704-179-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1744-191-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1744-196-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2284-207-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2284-212-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2548-223-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2548-228-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1608-239-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1608-244-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1736-254-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1736-259-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2936-270-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2936-275-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2324-284-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2324-288-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3048-297-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/3048-301-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2116-311-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2116-314-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1708-323-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1708-327-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2860-336-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2860-340-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1856-349-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1856-353-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2760-362-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 48 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm1.exe -
Drops file in System32 directory 46 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File opened for modification C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe File created C:\Windows\SysWOW64\wnpkm1.exe wnpkm1.exe -
Suspicious use of SetThreadContext 24 IoCs
description pid Process procid_target PID 2260 set thread context of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2824 set thread context of 2728 2824 wnpkm1.exe 31 PID 2560 set thread context of 1632 2560 wnpkm1.exe 33 PID 2296 set thread context of 2504 2296 wnpkm1.exe 35 PID 2924 set thread context of 2992 2924 wnpkm1.exe 37 PID 2760 set thread context of 1276 2760 wnpkm1.exe 39 PID 3012 set thread context of 392 3012 wnpkm1.exe 41 PID 472 set thread context of 2012 472 wnpkm1.exe 43 PID 2424 set thread context of 1688 2424 wnpkm1.exe 45 PID 2264 set thread context of 2376 2264 wnpkm1.exe 47 PID 2700 set thread context of 2704 2700 wnpkm1.exe 49 PID 808 set thread context of 1744 808 wnpkm1.exe 51 PID 2932 set thread context of 2284 2932 wnpkm1.exe 53 PID 3016 set thread context of 2548 3016 wnpkm1.exe 55 PID 1704 set thread context of 1608 1704 wnpkm1.exe 57 PID 2248 set thread context of 1736 2248 wnpkm1.exe 59 PID 1484 set thread context of 2936 1484 wnpkm1.exe 61 PID 1576 set thread context of 2324 1576 wnpkm1.exe 63 PID 2716 set thread context of 3048 2716 wnpkm1.exe 65 PID 2960 set thread context of 2116 2960 wnpkm1.exe 67 PID 2732 set thread context of 1708 2732 wnpkm1.exe 69 PID 2904 set thread context of 2860 2904 wnpkm1.exe 71 PID 3024 set thread context of 1856 3024 wnpkm1.exe 73 PID 1924 set thread context of 2760 1924 wnpkm1.exe 75 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm1.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 2728 wnpkm1.exe 1632 wnpkm1.exe 2504 wnpkm1.exe 2992 wnpkm1.exe 1276 wnpkm1.exe 392 wnpkm1.exe 2012 wnpkm1.exe 1688 wnpkm1.exe 2376 wnpkm1.exe 2704 wnpkm1.exe 1744 wnpkm1.exe 2284 wnpkm1.exe 2548 wnpkm1.exe 1608 wnpkm1.exe 1736 wnpkm1.exe 2936 wnpkm1.exe 2324 wnpkm1.exe 3048 wnpkm1.exe 2116 wnpkm1.exe 1708 wnpkm1.exe 2860 wnpkm1.exe 1856 wnpkm1.exe 2760 wnpkm1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 2260 wrote to memory of 1056 2260 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 29 PID 1056 wrote to memory of 2824 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 30 PID 1056 wrote to memory of 2824 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 30 PID 1056 wrote to memory of 2824 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 30 PID 1056 wrote to memory of 2824 1056 a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe 30 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2824 wrote to memory of 2728 2824 wnpkm1.exe 31 PID 2728 wrote to memory of 2560 2728 wnpkm1.exe 32 PID 2728 wrote to memory of 2560 2728 wnpkm1.exe 32 PID 2728 wrote to memory of 2560 2728 wnpkm1.exe 32 PID 2728 wrote to memory of 2560 2728 wnpkm1.exe 32 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 2560 wrote to memory of 1632 2560 wnpkm1.exe 33 PID 1632 wrote to memory of 2296 1632 wnpkm1.exe 34 PID 1632 wrote to memory of 2296 1632 wnpkm1.exe 34 PID 1632 wrote to memory of 2296 1632 wnpkm1.exe 34 PID 1632 wrote to memory of 2296 1632 wnpkm1.exe 34 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2296 wrote to memory of 2504 2296 wnpkm1.exe 35 PID 2504 wrote to memory of 2924 2504 wnpkm1.exe 36 PID 2504 wrote to memory of 2924 2504 wnpkm1.exe 36 PID 2504 wrote to memory of 2924 2504 wnpkm1.exe 36 PID 2504 wrote to memory of 2924 2504 wnpkm1.exe 36 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2924 wrote to memory of 2992 2924 wnpkm1.exe 37 PID 2992 wrote to memory of 2760 2992 wnpkm1.exe 38 PID 2992 wrote to memory of 2760 2992 wnpkm1.exe 38 PID 2992 wrote to memory of 2760 2992 wnpkm1.exe 38 PID 2992 wrote to memory of 2760 2992 wnpkm1.exe 38 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 2760 wrote to memory of 1276 2760 wnpkm1.exe 39 PID 1276 wrote to memory of 3012 1276 wnpkm1.exe 40 PID 1276 wrote to memory of 3012 1276 wnpkm1.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0f1cd20775f9e1ed0b40fb9122f529f_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Users\Admin\AppData\Local\Temp\A0F1CD~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Users\Admin\AppData\Local\Temp\A0F1CD~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3012 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:392 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:472 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1688 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:808 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1744 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2548 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1608 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1736 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2324 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2860 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1856 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Windows\SysWOW64\wnpkm1.exe"C:\Windows\system32\wnpkm1.exe" C:\Windows\SysWOW64\wnpkm1.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD5a0f1cd20775f9e1ed0b40fb9122f529f
SHA1639f8cd398fea2b12373c8ee4db5c3c6d7185517
SHA256f0279fe1b492cb8e9fe74fa7cedbf6de3adb6eb8106cfbc52cf4b1d4cdf27d96
SHA512483ab2ba34c301dad32e112813c52983362f103dd22fe7821184beab26f75854d2f86dcf436f93a23e8bd0e78b00509dac5dcf02ca81c1b698e5d10bef302ddf