Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe
-
Size
149KB
-
MD5
dcfd8de90c3200e5a2e46411ea2def3c
-
SHA1
fe5f3a1fdd3dff05144db389c8e183831a8dc975
-
SHA256
52b7fc761672109700f6f4c30535568dc0d0eeac8e50e7fc1de17a62bde95587
-
SHA512
0e9eda21498f5adf1cbcc9d987e55fdce833969453816aa3a31f262cddfcc0ec61a73ffee100d07bda4ac8711f77996ce6d69e4b675cd4f7ad82086f2ecb99b3
-
SSDEEP
3072:Cm/HyUM23BDfak2+PQNgwq3BykCBua7mLiT7GKPPsqETsxB:n/DMg8f1dq3BCBuugiTCKP7j
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation wmipsxdc.exe -
Deletes itself 1 IoCs
pid Process 756 wmipsxdc.exe -
Executes dropped EXE 60 IoCs
pid Process 4388 wmipsxdc.exe 756 wmipsxdc.exe 4460 wmipsxdc.exe 3584 wmipsxdc.exe 3268 wmipsxdc.exe 3980 wmipsxdc.exe 2068 wmipsxdc.exe 1580 wmipsxdc.exe 400 wmipsxdc.exe 64 wmipsxdc.exe 2372 wmipsxdc.exe 4760 wmipsxdc.exe 5036 wmipsxdc.exe 4124 wmipsxdc.exe 3792 wmipsxdc.exe 3112 wmipsxdc.exe 4176 wmipsxdc.exe 1156 wmipsxdc.exe 2440 wmipsxdc.exe 1972 wmipsxdc.exe 4448 wmipsxdc.exe 4648 wmipsxdc.exe 1400 wmipsxdc.exe 3316 wmipsxdc.exe 2356 wmipsxdc.exe 3888 wmipsxdc.exe 1588 wmipsxdc.exe 2648 wmipsxdc.exe 3272 wmipsxdc.exe 3900 wmipsxdc.exe 2708 wmipsxdc.exe 1220 wmipsxdc.exe 1728 wmipsxdc.exe 3824 wmipsxdc.exe 1040 wmipsxdc.exe 2072 wmipsxdc.exe 1460 wmipsxdc.exe 4704 wmipsxdc.exe 1636 wmipsxdc.exe 872 wmipsxdc.exe 552 wmipsxdc.exe 728 wmipsxdc.exe 4548 wmipsxdc.exe 2280 wmipsxdc.exe 4876 wmipsxdc.exe 3004 wmipsxdc.exe 1928 wmipsxdc.exe 4388 wmipsxdc.exe 3024 wmipsxdc.exe 2856 wmipsxdc.exe 4928 wmipsxdc.exe 1492 wmipsxdc.exe 4240 wmipsxdc.exe 4512 wmipsxdc.exe 4260 wmipsxdc.exe 1640 wmipsxdc.exe 868 wmipsxdc.exe 3600 wmipsxdc.exe 4372 wmipsxdc.exe 4844 wmipsxdc.exe -
resource yara_rule behavioral2/memory/2180-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2180-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2180-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2180-5-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2180-41-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/756-45-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/756-46-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/756-47-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/756-49-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3584-58-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3980-65-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1580-73-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/64-80-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4760-87-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4124-94-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3112-104-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1156-107-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1156-108-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1156-112-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1972-119-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4648-125-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3316-135-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3888-144-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2648-152-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3900-160-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1220-168-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3824-176-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2072-184-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4704-192-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/872-200-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/728-208-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2280-217-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3004-225-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4388-231-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2856-237-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1492-243-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4512-249-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1640-255-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3600-261-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 62 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmipsxdc.exe -
Drops file in System32 directory 60 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File opened for modification C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe File created C:\Windows\SysWOW64\wmipsxdc.exe wmipsxdc.exe -
Suspicious use of SetThreadContext 31 IoCs
description pid Process procid_target PID 1712 set thread context of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 4388 set thread context of 756 4388 wmipsxdc.exe 93 PID 4460 set thread context of 3584 4460 wmipsxdc.exe 96 PID 3268 set thread context of 3980 3268 wmipsxdc.exe 100 PID 2068 set thread context of 1580 2068 wmipsxdc.exe 102 PID 400 set thread context of 64 400 wmipsxdc.exe 104 PID 2372 set thread context of 4760 2372 wmipsxdc.exe 106 PID 5036 set thread context of 4124 5036 wmipsxdc.exe 110 PID 3792 set thread context of 3112 3792 wmipsxdc.exe 112 PID 4176 set thread context of 1156 4176 wmipsxdc.exe 114 PID 2440 set thread context of 1972 2440 wmipsxdc.exe 116 PID 4448 set thread context of 4648 4448 wmipsxdc.exe 118 PID 1400 set thread context of 3316 1400 wmipsxdc.exe 120 PID 2356 set thread context of 3888 2356 wmipsxdc.exe 122 PID 1588 set thread context of 2648 1588 wmipsxdc.exe 124 PID 3272 set thread context of 3900 3272 wmipsxdc.exe 126 PID 2708 set thread context of 1220 2708 wmipsxdc.exe 128 PID 1728 set thread context of 3824 1728 wmipsxdc.exe 130 PID 1040 set thread context of 2072 1040 wmipsxdc.exe 132 PID 1460 set thread context of 4704 1460 wmipsxdc.exe 134 PID 1636 set thread context of 872 1636 wmipsxdc.exe 136 PID 552 set thread context of 728 552 wmipsxdc.exe 138 PID 4548 set thread context of 2280 4548 wmipsxdc.exe 140 PID 4876 set thread context of 3004 4876 wmipsxdc.exe 142 PID 1928 set thread context of 4388 1928 wmipsxdc.exe 144 PID 3024 set thread context of 2856 3024 wmipsxdc.exe 146 PID 4928 set thread context of 1492 4928 wmipsxdc.exe 148 PID 4240 set thread context of 4512 4240 wmipsxdc.exe 150 PID 4260 set thread context of 1640 4260 wmipsxdc.exe 152 PID 868 set thread context of 3600 868 wmipsxdc.exe 154 PID 4372 set thread context of 4844 4372 wmipsxdc.exe 156 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmipsxdc.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmipsxdc.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2180 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 2180 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 756 wmipsxdc.exe 756 wmipsxdc.exe 3584 wmipsxdc.exe 3584 wmipsxdc.exe 3980 wmipsxdc.exe 3980 wmipsxdc.exe 1580 wmipsxdc.exe 1580 wmipsxdc.exe 64 wmipsxdc.exe 64 wmipsxdc.exe 4760 wmipsxdc.exe 4760 wmipsxdc.exe 4124 wmipsxdc.exe 4124 wmipsxdc.exe 3112 wmipsxdc.exe 3112 wmipsxdc.exe 1156 wmipsxdc.exe 1156 wmipsxdc.exe 1972 wmipsxdc.exe 1972 wmipsxdc.exe 4648 wmipsxdc.exe 4648 wmipsxdc.exe 3316 wmipsxdc.exe 3316 wmipsxdc.exe 3888 wmipsxdc.exe 3888 wmipsxdc.exe 2648 wmipsxdc.exe 2648 wmipsxdc.exe 3900 wmipsxdc.exe 3900 wmipsxdc.exe 1220 wmipsxdc.exe 1220 wmipsxdc.exe 3824 wmipsxdc.exe 3824 wmipsxdc.exe 2072 wmipsxdc.exe 2072 wmipsxdc.exe 4704 wmipsxdc.exe 4704 wmipsxdc.exe 872 wmipsxdc.exe 872 wmipsxdc.exe 728 wmipsxdc.exe 728 wmipsxdc.exe 2280 wmipsxdc.exe 2280 wmipsxdc.exe 3004 wmipsxdc.exe 3004 wmipsxdc.exe 4388 wmipsxdc.exe 4388 wmipsxdc.exe 2856 wmipsxdc.exe 2856 wmipsxdc.exe 1492 wmipsxdc.exe 1492 wmipsxdc.exe 4512 wmipsxdc.exe 4512 wmipsxdc.exe 1640 wmipsxdc.exe 1640 wmipsxdc.exe 3600 wmipsxdc.exe 3600 wmipsxdc.exe 4844 wmipsxdc.exe 4844 wmipsxdc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 1712 wrote to memory of 2180 1712 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 86 PID 2180 wrote to memory of 4388 2180 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 91 PID 2180 wrote to memory of 4388 2180 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 91 PID 2180 wrote to memory of 4388 2180 dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe 91 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 4388 wrote to memory of 756 4388 wmipsxdc.exe 93 PID 756 wrote to memory of 4460 756 wmipsxdc.exe 95 PID 756 wrote to memory of 4460 756 wmipsxdc.exe 95 PID 756 wrote to memory of 4460 756 wmipsxdc.exe 95 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 4460 wrote to memory of 3584 4460 wmipsxdc.exe 96 PID 3584 wrote to memory of 3268 3584 wmipsxdc.exe 99 PID 3584 wrote to memory of 3268 3584 wmipsxdc.exe 99 PID 3584 wrote to memory of 3268 3584 wmipsxdc.exe 99 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3268 wrote to memory of 3980 3268 wmipsxdc.exe 100 PID 3980 wrote to memory of 2068 3980 wmipsxdc.exe 101 PID 3980 wrote to memory of 2068 3980 wmipsxdc.exe 101 PID 3980 wrote to memory of 2068 3980 wmipsxdc.exe 101 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 2068 wrote to memory of 1580 2068 wmipsxdc.exe 102 PID 1580 wrote to memory of 400 1580 wmipsxdc.exe 103 PID 1580 wrote to memory of 400 1580 wmipsxdc.exe 103 PID 1580 wrote to memory of 400 1580 wmipsxdc.exe 103 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 400 wrote to memory of 64 400 wmipsxdc.exe 104 PID 64 wrote to memory of 2372 64 wmipsxdc.exe 105 PID 64 wrote to memory of 2372 64 wmipsxdc.exe 105 PID 64 wrote to memory of 2372 64 wmipsxdc.exe 105 PID 2372 wrote to memory of 4760 2372 wmipsxdc.exe 106 PID 2372 wrote to memory of 4760 2372 wmipsxdc.exe 106 PID 2372 wrote to memory of 4760 2372 wmipsxdc.exe 106 PID 2372 wrote to memory of 4760 2372 wmipsxdc.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dcfd8de90c3200e5a2e46411ea2def3c_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Users\Admin\AppData\Local\Temp\DCFD8D~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Users\Admin\AppData\Local\Temp\DCFD8D~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4760 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4124 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3112 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1156 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4648 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3316 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3888 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3272 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3900 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1220 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3824 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2072 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4704 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:872 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:552 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:728 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4548 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4388 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2856 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1492 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4512 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3600 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\system32\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4372 -
C:\Windows\SysWOW64\wmipsxdc.exe"C:\Windows\SysWOW64\wmipsxdc.exe" C:\Windows\SysWOW64\wmipsxdc.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD5dcfd8de90c3200e5a2e46411ea2def3c
SHA1fe5f3a1fdd3dff05144db389c8e183831a8dc975
SHA25652b7fc761672109700f6f4c30535568dc0d0eeac8e50e7fc1de17a62bde95587
SHA5120e9eda21498f5adf1cbcc9d987e55fdce833969453816aa3a31f262cddfcc0ec61a73ffee100d07bda4ac8711f77996ce6d69e4b675cd4f7ad82086f2ecb99b3