Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe
-
Size
198KB
-
MD5
f9038f1859b2e5d7f4a2d9a1aafb4f3e
-
SHA1
52ef34a49bfb8a7a0149fe24915daacd2b229d48
-
SHA256
5302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
-
SHA512
f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af
-
SSDEEP
3072:LAavosgPrJiX94Pp5H+tnp1ezSt+CFmngL2LvnUhxdmOw4YHLQM2HysCfx:LAog2p1AS1FmvvI8xQvSXx
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wmpdtc32.exe -
Deletes itself 1 IoCs
pid Process 1844 wmpdtc32.exe -
Executes dropped EXE 32 IoCs
pid Process 4020 wmpdtc32.exe 1844 wmpdtc32.exe 1588 wmpdtc32.exe 2996 wmpdtc32.exe 4572 wmpdtc32.exe 3420 wmpdtc32.exe 3660 wmpdtc32.exe 4284 wmpdtc32.exe 1452 wmpdtc32.exe 4912 wmpdtc32.exe 4988 wmpdtc32.exe 1512 wmpdtc32.exe 3520 wmpdtc32.exe 3580 wmpdtc32.exe 2012 wmpdtc32.exe 4960 wmpdtc32.exe 2612 wmpdtc32.exe 2644 wmpdtc32.exe 396 wmpdtc32.exe 5084 wmpdtc32.exe 1644 wmpdtc32.exe 4496 wmpdtc32.exe 3136 wmpdtc32.exe 3592 wmpdtc32.exe 3108 wmpdtc32.exe 3488 wmpdtc32.exe 1716 wmpdtc32.exe 1356 wmpdtc32.exe 4580 wmpdtc32.exe 1236 wmpdtc32.exe 1344 wmpdtc32.exe 4600 wmpdtc32.exe -
Maps connected drives based on registry 3 TTPs 34 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe -
Drops file in System32 directory 48 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdtc32.exe f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe -
Suspicious use of SetThreadContext 17 IoCs
description pid Process procid_target PID 5104 set thread context of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 4020 set thread context of 1844 4020 wmpdtc32.exe 86 PID 1588 set thread context of 2996 1588 wmpdtc32.exe 95 PID 4572 set thread context of 3420 4572 wmpdtc32.exe 97 PID 3660 set thread context of 4284 3660 wmpdtc32.exe 100 PID 1452 set thread context of 4912 1452 wmpdtc32.exe 102 PID 4988 set thread context of 1512 4988 wmpdtc32.exe 105 PID 3520 set thread context of 3580 3520 wmpdtc32.exe 107 PID 2012 set thread context of 4960 2012 wmpdtc32.exe 109 PID 2612 set thread context of 2644 2612 wmpdtc32.exe 111 PID 396 set thread context of 5084 396 wmpdtc32.exe 113 PID 1644 set thread context of 4496 1644 wmpdtc32.exe 115 PID 3136 set thread context of 3592 3136 wmpdtc32.exe 117 PID 3108 set thread context of 3488 3108 wmpdtc32.exe 119 PID 1716 set thread context of 1356 1716 wmpdtc32.exe 121 PID 4580 set thread context of 1236 4580 wmpdtc32.exe 123 PID 1344 set thread context of 4600 1344 wmpdtc32.exe 125 -
resource yara_rule behavioral2/memory/3096-1-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3096-4-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3096-5-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3096-6-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3096-33-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1844-46-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3096-48-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1844-50-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2996-59-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1844-60-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2996-63-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2996-69-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3420-74-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3420-78-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4284-84-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4284-87-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4912-94-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4912-98-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1512-103-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1512-107-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3580-113-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3580-117-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4960-124-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4960-128-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2644-133-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2644-137-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/5084-143-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/5084-149-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3592-156-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4496-155-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4496-160-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3592-165-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3592-171-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3488-176-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/3488-182-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1356-188-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1356-194-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1236-196-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1236-205-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtc32.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpdtc32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 1844 wmpdtc32.exe 1844 wmpdtc32.exe 1844 wmpdtc32.exe 1844 wmpdtc32.exe 2996 wmpdtc32.exe 2996 wmpdtc32.exe 2996 wmpdtc32.exe 2996 wmpdtc32.exe 3420 wmpdtc32.exe 3420 wmpdtc32.exe 3420 wmpdtc32.exe 3420 wmpdtc32.exe 4284 wmpdtc32.exe 4284 wmpdtc32.exe 4284 wmpdtc32.exe 4284 wmpdtc32.exe 4912 wmpdtc32.exe 4912 wmpdtc32.exe 4912 wmpdtc32.exe 4912 wmpdtc32.exe 1512 wmpdtc32.exe 1512 wmpdtc32.exe 1512 wmpdtc32.exe 1512 wmpdtc32.exe 3580 wmpdtc32.exe 3580 wmpdtc32.exe 3580 wmpdtc32.exe 3580 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 4960 wmpdtc32.exe 2644 wmpdtc32.exe 2644 wmpdtc32.exe 2644 wmpdtc32.exe 2644 wmpdtc32.exe 5084 wmpdtc32.exe 5084 wmpdtc32.exe 5084 wmpdtc32.exe 5084 wmpdtc32.exe 4496 wmpdtc32.exe 4496 wmpdtc32.exe 4496 wmpdtc32.exe 4496 wmpdtc32.exe 3592 wmpdtc32.exe 3592 wmpdtc32.exe 3592 wmpdtc32.exe 3592 wmpdtc32.exe 3488 wmpdtc32.exe 3488 wmpdtc32.exe 3488 wmpdtc32.exe 3488 wmpdtc32.exe 1356 wmpdtc32.exe 1356 wmpdtc32.exe 1356 wmpdtc32.exe 1356 wmpdtc32.exe 1236 wmpdtc32.exe 1236 wmpdtc32.exe 1236 wmpdtc32.exe 1236 wmpdtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 5104 wrote to memory of 3096 5104 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 84 PID 3096 wrote to memory of 4020 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3096 wrote to memory of 4020 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 3096 wrote to memory of 4020 3096 f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe 85 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 4020 wrote to memory of 1844 4020 wmpdtc32.exe 86 PID 1844 wrote to memory of 1588 1844 wmpdtc32.exe 94 PID 1844 wrote to memory of 1588 1844 wmpdtc32.exe 94 PID 1844 wrote to memory of 1588 1844 wmpdtc32.exe 94 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 1588 wrote to memory of 2996 1588 wmpdtc32.exe 95 PID 2996 wrote to memory of 4572 2996 wmpdtc32.exe 96 PID 2996 wrote to memory of 4572 2996 wmpdtc32.exe 96 PID 2996 wrote to memory of 4572 2996 wmpdtc32.exe 96 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 4572 wrote to memory of 3420 4572 wmpdtc32.exe 97 PID 3420 wrote to memory of 3660 3420 wmpdtc32.exe 99 PID 3420 wrote to memory of 3660 3420 wmpdtc32.exe 99 PID 3420 wrote to memory of 3660 3420 wmpdtc32.exe 99 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 3660 wrote to memory of 4284 3660 wmpdtc32.exe 100 PID 4284 wrote to memory of 1452 4284 wmpdtc32.exe 101 PID 4284 wrote to memory of 1452 4284 wmpdtc32.exe 101 PID 4284 wrote to memory of 1452 4284 wmpdtc32.exe 101 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 1452 wrote to memory of 4912 1452 wmpdtc32.exe 102 PID 4912 wrote to memory of 4988 4912 wmpdtc32.exe 104 PID 4912 wrote to memory of 4988 4912 wmpdtc32.exe 104 PID 4912 wrote to memory of 4988 4912 wmpdtc32.exe 104 PID 4988 wrote to memory of 1512 4988 wmpdtc32.exe 105 PID 4988 wrote to memory of 1512 4988 wmpdtc32.exe 105 PID 4988 wrote to memory of 1512 4988 wmpdtc32.exe 105 PID 4988 wrote to memory of 1512 4988 wmpdtc32.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9038f1859b2e5d7f4a2d9a1aafb4f3e_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\F9038F~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3520 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3580 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4960 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2644 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5084 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4496 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3592 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3488 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1356 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1236 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD5f9038f1859b2e5d7f4a2d9a1aafb4f3e
SHA152ef34a49bfb8a7a0149fe24915daacd2b229d48
SHA2565302fed858a18c66252c1956377743a44b383f398c89fe71628a358bb49e9a7c
SHA512f92a8ba383d552381fbb06030cd4bf671022f4c47c078ea57c63217222b9b6d497dd5e72e42614811c94b1d1c31d5af8c54b5cd6565146855d0cd5f0aa0d33af