Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 13:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe
-
Size
206KB
-
MD5
d20fe74386dbe61c0fb11c15341160d2
-
SHA1
38403239a431496a95f79eb1587d40ca2f430122
-
SHA256
1929eb51be7d02cf66186eb172b4df9a04cd4cd5a278e42e784628febe0aea09
-
SHA512
f2f7f5bc1d5eda12ae5875973bcccf1fa06a6102ac70b3570cf4ece18354b6f2b5e7af4fe71e370b26081565f40c51906c926fe1a0520befa6a5a8f582554cb5
-
SSDEEP
6144:i8xopQbQ0NdWOa0uhZNXCRHvMUW85OSnd6s:NxoibQ0NdWO4hnCJj9TB
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 28 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation MsDxClient.exe -
Deletes itself 1 IoCs
pid Process 3756 MsDxClient.exe -
Executes dropped EXE 56 IoCs
pid Process 4996 MsDxClient.exe 3756 MsDxClient.exe 3528 MsDxClient.exe 1360 MsDxClient.exe 5096 MsDxClient.exe 3344 MsDxClient.exe 100 MsDxClient.exe 4448 MsDxClient.exe 2264 MsDxClient.exe 3932 MsDxClient.exe 1956 MsDxClient.exe 4968 MsDxClient.exe 3292 MsDxClient.exe 2320 MsDxClient.exe 3732 MsDxClient.exe 2820 MsDxClient.exe 2412 MsDxClient.exe 4188 MsDxClient.exe 1980 MsDxClient.exe 3424 MsDxClient.exe 1776 MsDxClient.exe 2524 MsDxClient.exe 1900 MsDxClient.exe 2964 MsDxClient.exe 1536 MsDxClient.exe 1932 MsDxClient.exe 1336 MsDxClient.exe 3512 MsDxClient.exe 1212 MsDxClient.exe 4072 MsDxClient.exe 2264 MsDxClient.exe 4768 MsDxClient.exe 4428 MsDxClient.exe 4860 MsDxClient.exe 2768 MsDxClient.exe 760 MsDxClient.exe 1064 MsDxClient.exe 212 MsDxClient.exe 1572 MsDxClient.exe 4284 MsDxClient.exe 4924 MsDxClient.exe 4824 MsDxClient.exe 2192 MsDxClient.exe 2916 MsDxClient.exe 2908 MsDxClient.exe 704 MsDxClient.exe 2568 MsDxClient.exe 3468 MsDxClient.exe 2676 MsDxClient.exe 1872 MsDxClient.exe 1340 MsDxClient.exe 3896 MsDxClient.exe 2088 MsDxClient.exe 2968 MsDxClient.exe 4980 MsDxClient.exe 4012 MsDxClient.exe -
resource yara_rule behavioral2/memory/2532-0-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2532-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2532-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2532-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2532-38-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3756-43-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3756-44-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3756-45-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3756-47-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1360-55-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3344-62-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4448-69-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3932-76-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4968-83-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2320-90-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2820-98-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4188-105-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3424-112-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2524-120-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2964-129-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1932-137-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3512-145-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4072-154-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4768-162-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4860-171-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/760-179-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/212-188-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4284-196-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4824-204-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2916-213-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/704-221-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3468-228-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1872-234-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3896-240-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2968-246-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 58 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDxClient.exe -
Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File opened for modification C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe File created C:\Windows\SysWOW64\MsDxClient.exe MsDxClient.exe -
Suspicious use of SetThreadContext 29 IoCs
description pid Process procid_target PID 2704 set thread context of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 4996 set thread context of 3756 4996 MsDxClient.exe 88 PID 3528 set thread context of 1360 3528 MsDxClient.exe 90 PID 5096 set thread context of 3344 5096 MsDxClient.exe 92 PID 100 set thread context of 4448 100 MsDxClient.exe 94 PID 2264 set thread context of 3932 2264 MsDxClient.exe 98 PID 1956 set thread context of 4968 1956 MsDxClient.exe 104 PID 3292 set thread context of 2320 3292 MsDxClient.exe 108 PID 3732 set thread context of 2820 3732 MsDxClient.exe 110 PID 2412 set thread context of 4188 2412 MsDxClient.exe 112 PID 1980 set thread context of 3424 1980 MsDxClient.exe 114 PID 1776 set thread context of 2524 1776 MsDxClient.exe 116 PID 1900 set thread context of 2964 1900 MsDxClient.exe 119 PID 1536 set thread context of 1932 1536 MsDxClient.exe 121 PID 1336 set thread context of 3512 1336 MsDxClient.exe 123 PID 1212 set thread context of 4072 1212 MsDxClient.exe 125 PID 2264 set thread context of 4768 2264 MsDxClient.exe 127 PID 4428 set thread context of 4860 4428 MsDxClient.exe 129 PID 2768 set thread context of 760 2768 MsDxClient.exe 131 PID 1064 set thread context of 212 1064 MsDxClient.exe 133 PID 1572 set thread context of 4284 1572 MsDxClient.exe 135 PID 4924 set thread context of 4824 4924 MsDxClient.exe 138 PID 2192 set thread context of 2916 2192 MsDxClient.exe 140 PID 2908 set thread context of 704 2908 MsDxClient.exe 142 PID 2568 set thread context of 3468 2568 MsDxClient.exe 144 PID 2676 set thread context of 1872 2676 MsDxClient.exe 146 PID 1340 set thread context of 3896 1340 MsDxClient.exe 148 PID 2088 set thread context of 2968 2088 MsDxClient.exe 150 PID 4980 set thread context of 4012 4980 MsDxClient.exe 152 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 57 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDxClient.exe -
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDxClient.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2532 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 2532 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 3756 MsDxClient.exe 3756 MsDxClient.exe 1360 MsDxClient.exe 1360 MsDxClient.exe 3344 MsDxClient.exe 3344 MsDxClient.exe 4448 MsDxClient.exe 4448 MsDxClient.exe 3932 MsDxClient.exe 3932 MsDxClient.exe 4968 MsDxClient.exe 4968 MsDxClient.exe 2320 MsDxClient.exe 2320 MsDxClient.exe 2820 MsDxClient.exe 2820 MsDxClient.exe 4188 MsDxClient.exe 4188 MsDxClient.exe 3424 MsDxClient.exe 3424 MsDxClient.exe 2524 MsDxClient.exe 2524 MsDxClient.exe 2964 MsDxClient.exe 2964 MsDxClient.exe 1932 MsDxClient.exe 1932 MsDxClient.exe 3512 MsDxClient.exe 3512 MsDxClient.exe 4072 MsDxClient.exe 4072 MsDxClient.exe 4768 MsDxClient.exe 4768 MsDxClient.exe 4860 MsDxClient.exe 4860 MsDxClient.exe 760 MsDxClient.exe 760 MsDxClient.exe 212 MsDxClient.exe 212 MsDxClient.exe 4284 MsDxClient.exe 4284 MsDxClient.exe 4824 MsDxClient.exe 4824 MsDxClient.exe 2916 MsDxClient.exe 2916 MsDxClient.exe 704 MsDxClient.exe 704 MsDxClient.exe 3468 MsDxClient.exe 3468 MsDxClient.exe 1872 MsDxClient.exe 1872 MsDxClient.exe 3896 MsDxClient.exe 3896 MsDxClient.exe 2968 MsDxClient.exe 2968 MsDxClient.exe 4012 MsDxClient.exe 4012 MsDxClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2704 wrote to memory of 2532 2704 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 86 PID 2532 wrote to memory of 4996 2532 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 87 PID 2532 wrote to memory of 4996 2532 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 87 PID 2532 wrote to memory of 4996 2532 d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe 87 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 4996 wrote to memory of 3756 4996 MsDxClient.exe 88 PID 3756 wrote to memory of 3528 3756 MsDxClient.exe 89 PID 3756 wrote to memory of 3528 3756 MsDxClient.exe 89 PID 3756 wrote to memory of 3528 3756 MsDxClient.exe 89 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 3528 wrote to memory of 1360 3528 MsDxClient.exe 90 PID 1360 wrote to memory of 5096 1360 MsDxClient.exe 91 PID 1360 wrote to memory of 5096 1360 MsDxClient.exe 91 PID 1360 wrote to memory of 5096 1360 MsDxClient.exe 91 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 5096 wrote to memory of 3344 5096 MsDxClient.exe 92 PID 3344 wrote to memory of 100 3344 MsDxClient.exe 93 PID 3344 wrote to memory of 100 3344 MsDxClient.exe 93 PID 3344 wrote to memory of 100 3344 MsDxClient.exe 93 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 100 wrote to memory of 4448 100 MsDxClient.exe 94 PID 4448 wrote to memory of 2264 4448 MsDxClient.exe 95 PID 4448 wrote to memory of 2264 4448 MsDxClient.exe 95 PID 4448 wrote to memory of 2264 4448 MsDxClient.exe 95 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 2264 wrote to memory of 3932 2264 MsDxClient.exe 98 PID 3932 wrote to memory of 1956 3932 MsDxClient.exe 103 PID 3932 wrote to memory of 1956 3932 MsDxClient.exe 103 PID 3932 wrote to memory of 1956 3932 MsDxClient.exe 103 PID 1956 wrote to memory of 4968 1956 MsDxClient.exe 104 PID 1956 wrote to memory of 4968 1956 MsDxClient.exe 104 PID 1956 wrote to memory of 4968 1956 MsDxClient.exe 104 PID 1956 wrote to memory of 4968 1956 MsDxClient.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d20fe74386dbe61c0fb11c15341160d2_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Users\Admin\AppData\Local\Temp\D20FE7~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Users\Admin\AppData\Local\Temp\D20FE7~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4968 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2320 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3424 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2524 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2964 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1536 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1932 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3512 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4072 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4768 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4860 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:760 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:212 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4284 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4824 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:704 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3468 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1872 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1340 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3896 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2968 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\system32\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\SysWOW64\MsDxClient.exe"C:\Windows\SysWOW64\MsDxClient.exe" C:\Windows\SysWOW64\MSDXCL~1.EXE58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5d20fe74386dbe61c0fb11c15341160d2
SHA138403239a431496a95f79eb1587d40ca2f430122
SHA2561929eb51be7d02cf66186eb172b4df9a04cd4cd5a278e42e784628febe0aea09
SHA512f2f7f5bc1d5eda12ae5875973bcccf1fa06a6102ac70b3570cf4ece18354b6f2b5e7af4fe71e370b26081565f40c51906c926fe1a0520befa6a5a8f582554cb5