Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 02:35
General
-
Target
e189feb2abd4f0705dd9857e1ef3d011_JaffaCakes118.exe
-
Size
173KB
-
MD5
e189feb2abd4f0705dd9857e1ef3d011
-
SHA1
0bf9cdf7d76ff16330aeb500635ec6dc6c2b9fee
-
SHA256
905d3ef8ccef644ebb75dfd2c6581e60f160f45c48690a6fd44e2a59529e9c36
-
SHA512
de82b6baf6fcd7708919d8f34078ae9e553be9b79cdef11e3cf060a8c727e0571be6a6be4d531db94908684e46b7396c5f773e6b95cf157fed4f6328410de642
-
SSDEEP
3072:lCH44oraCJ/+rzxc3N80h/B+chaZi+VST3c1KxIn+DoR/E6atw3kJeN46kSGJ:t4o5Q480h/MucwLc1KxI+Ehd0em7
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 36 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 64 IoCs
-
UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 37 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 36 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e189feb2abd4f0705dd9857e1ef3d011_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e189feb2abd4f0705dd9857e1ef3d011_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e189feb2abd4f0705dd9857e1ef3d011_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e189feb2abd4f0705dd9857e1ef3d011_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Users\Admin\AppData\Local\Temp\E189FE~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Users\Admin\AppData\Local\Temp\E189FE~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE62⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE64⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE66⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE67⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE68⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE70⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE71⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE72⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\system32\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\MsPfClient.exe"C:\Windows\SysWOW64\MsPfClient.exe" C:\Windows\SysWOW64\MSPFCL~1.EXE74⤵
- Maps connected drives based on registry
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173KB
MD5e189feb2abd4f0705dd9857e1ef3d011
SHA10bf9cdf7d76ff16330aeb500635ec6dc6c2b9fee
SHA256905d3ef8ccef644ebb75dfd2c6581e60f160f45c48690a6fd44e2a59529e9c36
SHA512de82b6baf6fcd7708919d8f34078ae9e553be9b79cdef11e3cf060a8c727e0571be6a6be4d531db94908684e46b7396c5f773e6b95cf157fed4f6328410de642
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB