Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe
-
Size
157KB
-
MD5
dd83605df83306788faeba72af32e1ad
-
SHA1
d945ee5d353c56f727459bdae89eab0b8c59c6f2
-
SHA256
85c9d1f72e27b4328d66d9eb34d5ca0e19219d39f5980c6dc4a4bd1c0be86f8b
-
SHA512
bf4f5907a645cd9d1c74d391a7562e0160df2ac617633bee518a18ecb0a7f0b0682a952ee49d751ead334c6d1f58e77ce31540696143c6a15eff0f1ac706aec3
-
SSDEEP
3072:ZJvo9Uul5Wtpm/2jabEzCJmJcN7VCj7cAnXPduXwvS4zSB1HLm1:ZJvomYWDsXbEzCJmJcN7VCXcAVumfqFy
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation MsScClient.exe -
Deletes itself 1 IoCs
pid Process 1752 MsScClient.exe -
Executes dropped EXE 60 IoCs
pid Process 1360 MsScClient.exe 1752 MsScClient.exe 364 MsScClient.exe 2192 MsScClient.exe 1828 MsScClient.exe 2004 MsScClient.exe 2444 MsScClient.exe 1492 MsScClient.exe 752 MsScClient.exe 2656 MsScClient.exe 1704 MsScClient.exe 1712 MsScClient.exe 2832 MsScClient.exe 3024 MsScClient.exe 1588 MsScClient.exe 3000 MsScClient.exe 2684 MsScClient.exe 3108 MsScClient.exe 412 MsScClient.exe 3240 MsScClient.exe 2864 MsScClient.exe 3124 MsScClient.exe 3292 MsScClient.exe 2320 MsScClient.exe 4652 MsScClient.exe 4724 MsScClient.exe 2020 MsScClient.exe 2200 MsScClient.exe 2572 MsScClient.exe 1028 MsScClient.exe 1496 MsScClient.exe 1648 MsScClient.exe 3516 MsScClient.exe 3020 MsScClient.exe 4612 MsScClient.exe 3508 MsScClient.exe 1548 MsScClient.exe 3228 MsScClient.exe 220 MsScClient.exe 3216 MsScClient.exe 3272 MsScClient.exe 4088 MsScClient.exe 5000 MsScClient.exe 4772 MsScClient.exe 412 MsScClient.exe 4912 MsScClient.exe 3436 MsScClient.exe 1300 MsScClient.exe 992 MsScClient.exe 2284 MsScClient.exe 3304 MsScClient.exe 2224 MsScClient.exe 3260 MsScClient.exe 508 MsScClient.exe 404 MsScClient.exe 1736 MsScClient.exe 3968 MsScClient.exe 4136 MsScClient.exe 2292 MsScClient.exe 752 MsScClient.exe -
resource yara_rule behavioral2/memory/4704-0-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4704-2-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4704-3-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4704-4-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4704-40-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1752-46-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1752-48-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2192-57-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2004-64-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1492-71-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2656-77-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1712-85-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3024-92-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3000-99-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3108-107-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3240-114-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3124-121-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2320-130-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4724-138-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2200-146-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1028-154-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1648-163-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3020-171-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3508-179-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3228-187-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3216-195-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4088-203-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4772-211-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4912-217-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1300-223-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2284-229-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/2224-235-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/508-241-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/1736-247-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4136-253-0x0000000000400000-0x0000000000463000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 62 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsScClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsScClient.exe -
Drops file in System32 directory 60 IoCs
description ioc Process File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File created C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe File opened for modification C:\Windows\SysWOW64\MsScClient.exe MsScClient.exe -
Suspicious use of SetThreadContext 31 IoCs
description pid Process procid_target PID 4428 set thread context of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 1360 set thread context of 1752 1360 MsScClient.exe 92 PID 364 set thread context of 2192 364 MsScClient.exe 96 PID 1828 set thread context of 2004 1828 MsScClient.exe 100 PID 2444 set thread context of 1492 2444 MsScClient.exe 102 PID 752 set thread context of 2656 752 MsScClient.exe 104 PID 1704 set thread context of 1712 1704 MsScClient.exe 106 PID 2832 set thread context of 3024 2832 MsScClient.exe 110 PID 1588 set thread context of 3000 1588 MsScClient.exe 112 PID 2684 set thread context of 3108 2684 MsScClient.exe 114 PID 412 set thread context of 3240 412 MsScClient.exe 116 PID 2864 set thread context of 3124 2864 MsScClient.exe 118 PID 3292 set thread context of 2320 3292 MsScClient.exe 120 PID 4652 set thread context of 4724 4652 MsScClient.exe 122 PID 2020 set thread context of 2200 2020 MsScClient.exe 124 PID 2572 set thread context of 1028 2572 MsScClient.exe 126 PID 1496 set thread context of 1648 1496 MsScClient.exe 128 PID 3516 set thread context of 3020 3516 MsScClient.exe 130 PID 4612 set thread context of 3508 4612 MsScClient.exe 132 PID 1548 set thread context of 3228 1548 MsScClient.exe 134 PID 220 set thread context of 3216 220 MsScClient.exe 136 PID 3272 set thread context of 4088 3272 MsScClient.exe 138 PID 5000 set thread context of 4772 5000 MsScClient.exe 140 PID 412 set thread context of 4912 412 MsScClient.exe 142 PID 3436 set thread context of 1300 3436 MsScClient.exe 144 PID 992 set thread context of 2284 992 MsScClient.exe 146 PID 3304 set thread context of 2224 3304 MsScClient.exe 148 PID 3260 set thread context of 508 3260 MsScClient.exe 150 PID 404 set thread context of 1736 404 MsScClient.exe 152 PID 3968 set thread context of 4136 3968 MsScClient.exe 154 PID 2292 set thread context of 752 2292 MsScClient.exe 156 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsScClient.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsScClient.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4704 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 4704 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 1752 MsScClient.exe 1752 MsScClient.exe 2192 MsScClient.exe 2192 MsScClient.exe 2004 MsScClient.exe 2004 MsScClient.exe 1492 MsScClient.exe 1492 MsScClient.exe 2656 MsScClient.exe 2656 MsScClient.exe 1712 MsScClient.exe 1712 MsScClient.exe 3024 MsScClient.exe 3024 MsScClient.exe 3000 MsScClient.exe 3000 MsScClient.exe 3108 MsScClient.exe 3108 MsScClient.exe 3240 MsScClient.exe 3240 MsScClient.exe 3124 MsScClient.exe 3124 MsScClient.exe 2320 MsScClient.exe 2320 MsScClient.exe 4724 MsScClient.exe 4724 MsScClient.exe 2200 MsScClient.exe 2200 MsScClient.exe 1028 MsScClient.exe 1028 MsScClient.exe 1648 MsScClient.exe 1648 MsScClient.exe 3020 MsScClient.exe 3020 MsScClient.exe 3508 MsScClient.exe 3508 MsScClient.exe 3228 MsScClient.exe 3228 MsScClient.exe 3216 MsScClient.exe 3216 MsScClient.exe 4088 MsScClient.exe 4088 MsScClient.exe 4772 MsScClient.exe 4772 MsScClient.exe 4912 MsScClient.exe 4912 MsScClient.exe 1300 MsScClient.exe 1300 MsScClient.exe 2284 MsScClient.exe 2284 MsScClient.exe 2224 MsScClient.exe 2224 MsScClient.exe 508 MsScClient.exe 508 MsScClient.exe 1736 MsScClient.exe 1736 MsScClient.exe 4136 MsScClient.exe 4136 MsScClient.exe 752 MsScClient.exe 752 MsScClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4428 wrote to memory of 4704 4428 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 85 PID 4704 wrote to memory of 1360 4704 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 90 PID 4704 wrote to memory of 1360 4704 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 90 PID 4704 wrote to memory of 1360 4704 dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe 90 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1360 wrote to memory of 1752 1360 MsScClient.exe 92 PID 1752 wrote to memory of 364 1752 MsScClient.exe 95 PID 1752 wrote to memory of 364 1752 MsScClient.exe 95 PID 1752 wrote to memory of 364 1752 MsScClient.exe 95 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 364 wrote to memory of 2192 364 MsScClient.exe 96 PID 2192 wrote to memory of 1828 2192 MsScClient.exe 99 PID 2192 wrote to memory of 1828 2192 MsScClient.exe 99 PID 2192 wrote to memory of 1828 2192 MsScClient.exe 99 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 1828 wrote to memory of 2004 1828 MsScClient.exe 100 PID 2004 wrote to memory of 2444 2004 MsScClient.exe 101 PID 2004 wrote to memory of 2444 2004 MsScClient.exe 101 PID 2004 wrote to memory of 2444 2004 MsScClient.exe 101 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 2444 wrote to memory of 1492 2444 MsScClient.exe 102 PID 1492 wrote to memory of 752 1492 MsScClient.exe 103 PID 1492 wrote to memory of 752 1492 MsScClient.exe 103 PID 1492 wrote to memory of 752 1492 MsScClient.exe 103 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 752 wrote to memory of 2656 752 MsScClient.exe 104 PID 2656 wrote to memory of 1704 2656 MsScClient.exe 105 PID 2656 wrote to memory of 1704 2656 MsScClient.exe 105 PID 2656 wrote to memory of 1704 2656 MsScClient.exe 105 PID 1704 wrote to memory of 1712 1704 MsScClient.exe 106 PID 1704 wrote to memory of 1712 1704 MsScClient.exe 106 PID 1704 wrote to memory of 1712 1704 MsScClient.exe 106 PID 1704 wrote to memory of 1712 1704 MsScClient.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd83605df83306788faeba72af32e1ad_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Users\Admin\AppData\Local\Temp\DD8360~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Users\Admin\AppData\Local\Temp\DD8360~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1712 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3024 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3108 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3240 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3124 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2320 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4724 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2200 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1028 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1648 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3020 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3508 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3228 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:220 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3216 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3272 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4088 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4772 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4912 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1300 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:508 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:404 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1736 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4136 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\system32\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\MsScClient.exe"C:\Windows\SysWOW64\MsScClient.exe" C:\Windows\SysWOW64\MSSCCL~1.EXE62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD5dd83605df83306788faeba72af32e1ad
SHA1d945ee5d353c56f727459bdae89eab0b8c59c6f2
SHA25685c9d1f72e27b4328d66d9eb34d5ca0e19219d39f5980c6dc4a4bd1c0be86f8b
SHA512bf4f5907a645cd9d1c74d391a7562e0160df2ac617633bee518a18ecb0a7f0b0682a952ee49d751ead334c6d1f58e77ce31540696143c6a15eff0f1ac706aec3