Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 10:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe
-
Size
231KB
-
MD5
2f7e99a8d81f53459557f0cb83776f49
-
SHA1
dc26b247d6c22de6bf5e729670d97c12d563584d
-
SHA256
c9f0448ff2c35886efd6685548041469f9bf54562cfee17bed71818f16d86e60
-
SHA512
acad82afa9a41fcf37fd463ec6dbe05390d6203df1d287894e6e34281cb13fead5239d097288bb4ea57155e91cf3244b68dba10340c64874168f28d782128035
-
SSDEEP
6144:hocOTMXnd4orXh0baJiwuWJfycskHu90u:hJOYXndrDjJPfq0u
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wmiptsn.exe -
Deletes itself 1 IoCs
pid Process 3360 wmiptsn.exe -
Executes dropped EXE 64 IoCs
pid Process 860 wmiptsn.exe 3360 wmiptsn.exe 3928 wmiptsn.exe 4824 wmiptsn.exe 1268 wmiptsn.exe 5012 wmiptsn.exe 940 wmiptsn.exe 2272 wmiptsn.exe 4536 wmiptsn.exe 1316 wmiptsn.exe 1740 wmiptsn.exe 2764 wmiptsn.exe 1344 wmiptsn.exe 1716 wmiptsn.exe 2932 wmiptsn.exe 1012 wmiptsn.exe 2924 wmiptsn.exe 1752 wmiptsn.exe 3308 wmiptsn.exe 680 wmiptsn.exe 3448 wmiptsn.exe 3688 wmiptsn.exe 1872 wmiptsn.exe 368 wmiptsn.exe 4844 wmiptsn.exe 4692 wmiptsn.exe 3804 wmiptsn.exe 4088 wmiptsn.exe 2276 wmiptsn.exe 5060 wmiptsn.exe 2240 wmiptsn.exe 3564 wmiptsn.exe 2072 wmiptsn.exe 3008 wmiptsn.exe 3336 wmiptsn.exe 5096 wmiptsn.exe 1244 wmiptsn.exe 2168 wmiptsn.exe 1740 wmiptsn.exe 4304 wmiptsn.exe 3684 wmiptsn.exe 4180 wmiptsn.exe 2932 wmiptsn.exe 4176 wmiptsn.exe 2940 wmiptsn.exe 4116 wmiptsn.exe 3308 wmiptsn.exe 4300 wmiptsn.exe 4752 wmiptsn.exe 2100 wmiptsn.exe 1432 wmiptsn.exe 1056 wmiptsn.exe 4416 wmiptsn.exe 3400 wmiptsn.exe 5064 wmiptsn.exe 1772 wmiptsn.exe 1476 wmiptsn.exe 2712 wmiptsn.exe 3836 wmiptsn.exe 2896 wmiptsn.exe 1804 wmiptsn.exe 3272 wmiptsn.exe 3544 wmiptsn.exe 5116 wmiptsn.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File opened for modification C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe File created C:\Windows\SysWOW64\wmiptsn.exe wmiptsn.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 3916 set thread context of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 860 set thread context of 3360 860 wmiptsn.exe 88 PID 3928 set thread context of 4824 3928 wmiptsn.exe 90 PID 1268 set thread context of 5012 1268 wmiptsn.exe 92 PID 940 set thread context of 2272 940 wmiptsn.exe 94 PID 4536 set thread context of 1316 4536 wmiptsn.exe 96 PID 1740 set thread context of 2764 1740 wmiptsn.exe 98 PID 1344 set thread context of 1716 1344 wmiptsn.exe 100 PID 2932 set thread context of 1012 2932 wmiptsn.exe 102 PID 2924 set thread context of 1752 2924 wmiptsn.exe 104 PID 3308 set thread context of 680 3308 wmiptsn.exe 106 PID 3448 set thread context of 3688 3448 wmiptsn.exe 108 PID 1872 set thread context of 368 1872 wmiptsn.exe 110 PID 4844 set thread context of 4692 4844 wmiptsn.exe 115 PID 3804 set thread context of 4088 3804 wmiptsn.exe 117 PID 2276 set thread context of 5060 2276 wmiptsn.exe 120 PID 2240 set thread context of 3564 2240 wmiptsn.exe 122 PID 2072 set thread context of 3008 2072 wmiptsn.exe 124 PID 3336 set thread context of 5096 3336 wmiptsn.exe 126 PID 1244 set thread context of 2168 1244 wmiptsn.exe 128 PID 1740 set thread context of 4304 1740 wmiptsn.exe 130 PID 3684 set thread context of 4180 3684 wmiptsn.exe 132 PID 2932 set thread context of 4176 2932 wmiptsn.exe 134 PID 2940 set thread context of 4116 2940 wmiptsn.exe 136 PID 3308 set thread context of 4300 3308 wmiptsn.exe 138 PID 4752 set thread context of 2100 4752 wmiptsn.exe 140 PID 1432 set thread context of 1056 1432 wmiptsn.exe 142 PID 4416 set thread context of 3400 4416 wmiptsn.exe 144 PID 5064 set thread context of 1772 5064 wmiptsn.exe 146 PID 1476 set thread context of 2712 1476 wmiptsn.exe 148 PID 3836 set thread context of 2896 3836 wmiptsn.exe 150 PID 1804 set thread context of 3272 1804 wmiptsn.exe 152 PID 3544 set thread context of 5116 3544 wmiptsn.exe 154 PID 3632 set thread context of 2144 3632 wmiptsn.exe 156 PID 3396 set thread context of 940 3396 wmiptsn.exe 158 PID 3504 set thread context of 1276 3504 wmiptsn.exe 160 PID 1300 set thread context of 3984 1300 wmiptsn.exe 162 PID 4364 set thread context of 4700 4364 wmiptsn.exe 164 PID 684 set thread context of 3684 684 wmiptsn.exe 166 PID 872 set thread context of 1116 872 wmiptsn.exe 168 PID 1436 set thread context of 1264 1436 wmiptsn.exe 170 PID 3308 set thread context of 4820 3308 wmiptsn.exe 172 PID 2772 set thread context of 3900 2772 wmiptsn.exe 174 PID 1816 set thread context of 2760 1816 wmiptsn.exe 176 PID 4128 set thread context of 216 4128 wmiptsn.exe 178 PID 1492 set thread context of 1824 1492 wmiptsn.exe 180 PID 4400 set thread context of 640 4400 wmiptsn.exe 182 PID 860 set thread context of 3420 860 wmiptsn.exe 184 PID 1008 set thread context of 1600 1008 wmiptsn.exe 186 PID 3976 set thread context of 2944 3976 wmiptsn.exe 188 PID 2364 set thread context of 3620 2364 wmiptsn.exe 190 PID 1956 set thread context of 2240 1956 wmiptsn.exe 192 PID 5080 set thread context of 776 5080 wmiptsn.exe 194 PID 1568 set thread context of 3180 1568 wmiptsn.exe 196 PID 2904 set thread context of 3940 2904 wmiptsn.exe 198 PID 4160 set thread context of 1344 4160 wmiptsn.exe 200 PID 4028 set thread context of 924 4028 wmiptsn.exe 202 PID 3096 set thread context of 2940 3096 wmiptsn.exe 204 PID 320 set thread context of 4712 320 wmiptsn.exe 206 PID 3448 set thread context of 1996 3448 wmiptsn.exe 208 PID 3368 set thread context of 3052 3368 wmiptsn.exe 210 PID 4480 set thread context of 5008 4480 wmiptsn.exe 212 PID 5040 set thread context of 2216 5040 wmiptsn.exe 214 PID 2032 set thread context of 3988 2032 wmiptsn.exe 216 -
resource yara_rule behavioral2/memory/2308-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2308-2-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2308-3-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2308-4-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2308-37-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3360-43-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3360-44-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3360-45-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3360-47-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4824-54-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/5012-63-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2272-69-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1316-78-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2764-83-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1716-90-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1012-98-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1752-105-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/680-112-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3688-121-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/368-129-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4692-137-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4088-145-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/5060-153-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3564-161-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3008-170-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/5096-178-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2168-186-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4304-194-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4180-203-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4176-211-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4116-217-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4300-223-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2100-229-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1056-235-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3400-241-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1772-247-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2712-253-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2896-259-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3272-265-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/5116-271-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2144-277-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/940-283-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1276-289-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3984-295-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4700-301-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3684-307-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1116-313-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1264-319-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/4820-325-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3900-331-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2760-337-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/216-343-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1824-349-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/640-355-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3420-361-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1600-367-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2944-373-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3620-379-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2240-385-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/776-391-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3180-397-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3940-403-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1344-409-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/924-415-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsn.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsn.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 2308 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 3360 wmiptsn.exe 3360 wmiptsn.exe 4824 wmiptsn.exe 4824 wmiptsn.exe 5012 wmiptsn.exe 5012 wmiptsn.exe 2272 wmiptsn.exe 2272 wmiptsn.exe 1316 wmiptsn.exe 1316 wmiptsn.exe 2764 wmiptsn.exe 2764 wmiptsn.exe 1716 wmiptsn.exe 1716 wmiptsn.exe 1012 wmiptsn.exe 1012 wmiptsn.exe 1752 wmiptsn.exe 1752 wmiptsn.exe 680 wmiptsn.exe 680 wmiptsn.exe 3688 wmiptsn.exe 3688 wmiptsn.exe 368 wmiptsn.exe 368 wmiptsn.exe 4692 wmiptsn.exe 4692 wmiptsn.exe 4088 wmiptsn.exe 4088 wmiptsn.exe 5060 wmiptsn.exe 5060 wmiptsn.exe 3564 wmiptsn.exe 3564 wmiptsn.exe 3008 wmiptsn.exe 3008 wmiptsn.exe 5096 wmiptsn.exe 5096 wmiptsn.exe 2168 wmiptsn.exe 2168 wmiptsn.exe 4304 wmiptsn.exe 4304 wmiptsn.exe 4180 wmiptsn.exe 4180 wmiptsn.exe 4176 wmiptsn.exe 4176 wmiptsn.exe 4116 wmiptsn.exe 4116 wmiptsn.exe 4300 wmiptsn.exe 4300 wmiptsn.exe 2100 wmiptsn.exe 2100 wmiptsn.exe 1056 wmiptsn.exe 1056 wmiptsn.exe 3400 wmiptsn.exe 3400 wmiptsn.exe 1772 wmiptsn.exe 1772 wmiptsn.exe 2712 wmiptsn.exe 2712 wmiptsn.exe 2896 wmiptsn.exe 2896 wmiptsn.exe 3272 wmiptsn.exe 3272 wmiptsn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 3916 wrote to memory of 2308 3916 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 86 PID 2308 wrote to memory of 860 2308 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 87 PID 2308 wrote to memory of 860 2308 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 87 PID 2308 wrote to memory of 860 2308 2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe 87 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 860 wrote to memory of 3360 860 wmiptsn.exe 88 PID 3360 wrote to memory of 3928 3360 wmiptsn.exe 89 PID 3360 wrote to memory of 3928 3360 wmiptsn.exe 89 PID 3360 wrote to memory of 3928 3360 wmiptsn.exe 89 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 3928 wrote to memory of 4824 3928 wmiptsn.exe 90 PID 4824 wrote to memory of 1268 4824 wmiptsn.exe 91 PID 4824 wrote to memory of 1268 4824 wmiptsn.exe 91 PID 4824 wrote to memory of 1268 4824 wmiptsn.exe 91 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 1268 wrote to memory of 5012 1268 wmiptsn.exe 92 PID 5012 wrote to memory of 940 5012 wmiptsn.exe 93 PID 5012 wrote to memory of 940 5012 wmiptsn.exe 93 PID 5012 wrote to memory of 940 5012 wmiptsn.exe 93 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 940 wrote to memory of 2272 940 wmiptsn.exe 94 PID 2272 wrote to memory of 4536 2272 wmiptsn.exe 95 PID 2272 wrote to memory of 4536 2272 wmiptsn.exe 95 PID 2272 wrote to memory of 4536 2272 wmiptsn.exe 95 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 4536 wrote to memory of 1316 4536 wmiptsn.exe 96 PID 1316 wrote to memory of 1740 1316 wmiptsn.exe 97 PID 1316 wrote to memory of 1740 1316 wmiptsn.exe 97 PID 1316 wrote to memory of 1740 1316 wmiptsn.exe 97 PID 1740 wrote to memory of 2764 1740 wmiptsn.exe 98 PID 1740 wrote to memory of 2764 1740 wmiptsn.exe 98 PID 1740 wrote to memory of 2764 1740 wmiptsn.exe 98 PID 1740 wrote to memory of 2764 1740 wmiptsn.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f7e99a8d81f53459557f0cb83776f49_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Users\Admin\AppData\Local\Temp\2F7E99~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Users\Admin\AppData\Local\Temp\2F7E99~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2932 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1012 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1752 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3308 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:680 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3688 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:368 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3804 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4088 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2276 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5060 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3564 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2072 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3008 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3336 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5096 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1244 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2168 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4304 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3684 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4180 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2932 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4176 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2940 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4116 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4300 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4752 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1056 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4416 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3400 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1772 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3836 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2896 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1804 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3272 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3544 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5116 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe67⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3632 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe68⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2144 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe70⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe71⤵
- Suspicious use of SetThreadContext
PID:3504 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe72⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1276 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1300 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe74⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3984 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe76⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4700 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe77⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:684 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe78⤵
- Checks computer location settings
- Modifies registry class
PID:3684 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe79⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:872 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1116 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe81⤵
- Suspicious use of SetThreadContext
PID:1436 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1264 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe83⤵
- Suspicious use of SetThreadContext
PID:3308 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe84⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4820 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe85⤵
- Suspicious use of SetThreadContext
PID:2772 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe86⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3900 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe87⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe88⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe89⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe90⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:216 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe91⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe92⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1824 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe93⤵
- Suspicious use of SetThreadContext
PID:4400 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe94⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:640 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe95⤵
- Suspicious use of SetThreadContext
PID:860 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe96⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3420 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe97⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe98⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1600 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe99⤵
- Suspicious use of SetThreadContext
PID:3976 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe100⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2944 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe102⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3620 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe103⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe104⤵
- Checks computer location settings
- Modifies registry class
PID:2240 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe105⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe106⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:776 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe107⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe108⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3180 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe109⤵
- Suspicious use of SetThreadContext
PID:2904 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe110⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3940 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe111⤵
- Suspicious use of SetThreadContext
PID:4160 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe112⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1344 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe113⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4028 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe114⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:924 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe115⤵
- Suspicious use of SetThreadContext
PID:3096 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe116⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2940 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe117⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:320 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe118⤵
- Checks computer location settings
- Modifies registry class
PID:4712 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe119⤵
- Suspicious use of SetThreadContext
PID:3448 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe120⤵
- Checks computer location settings
- Modifies registry class
PID:1996 -
C:\Windows\SysWOW64\wmiptsn.exe"C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe121⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-