Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe
-
Size
160KB
-
MD5
90df2ee61b9f57b1f9a84fbfe7229956
-
SHA1
2a7661c18a53a803e70f4b240d6cbf65f5da877e
-
SHA256
e16633a047908f513cbdcb2fb3a11768c0477bd71a47f59ad4fb745b6718016c
-
SHA512
43c6acefc7fab1fbfc0f28e858b223e6635b13dcf12416893f1f432d51f0da84866d8bb22dea9d9d441258a50f90e66efdff068e5f615622c9c6be6cbe719249
-
SSDEEP
3072:EwFzDhkZHdMGKhkXaW+/8z4SmwIGkr/VP4qFksnliFvt8AC+c:1FJeSSxtKwxkr/p4qiIi8
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 25 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wnpkm2.exe -
Deletes itself 1 IoCs
pid Process 4968 wnpkm2.exe -
Executes dropped EXE 48 IoCs
pid Process 3264 wnpkm2.exe 4968 wnpkm2.exe 4828 wnpkm2.exe 1116 wnpkm2.exe 3176 wnpkm2.exe 3852 wnpkm2.exe 4856 wnpkm2.exe 3468 wnpkm2.exe 4600 wnpkm2.exe 3240 wnpkm2.exe 2736 wnpkm2.exe 4136 wnpkm2.exe 4452 wnpkm2.exe 2952 wnpkm2.exe 1352 wnpkm2.exe 2432 wnpkm2.exe 4312 wnpkm2.exe 3736 wnpkm2.exe 3044 wnpkm2.exe 1188 wnpkm2.exe 4836 wnpkm2.exe 4280 wnpkm2.exe 4764 wnpkm2.exe 1060 wnpkm2.exe 4112 wnpkm2.exe 2444 wnpkm2.exe 1040 wnpkm2.exe 3456 wnpkm2.exe 4800 wnpkm2.exe 4552 wnpkm2.exe 852 wnpkm2.exe 4988 wnpkm2.exe 4464 wnpkm2.exe 2068 wnpkm2.exe 3000 wnpkm2.exe 2988 wnpkm2.exe 3616 wnpkm2.exe 4912 wnpkm2.exe 4244 wnpkm2.exe 4952 wnpkm2.exe 2564 wnpkm2.exe 3572 wnpkm2.exe 2328 wnpkm2.exe 1068 wnpkm2.exe 1960 wnpkm2.exe 3688 wnpkm2.exe 2748 wnpkm2.exe 2556 wnpkm2.exe -
Maps connected drives based on registry 3 TTPs 50 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpkm2.exe -
Drops file in System32 directory 50 IoCs
description ioc Process File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File created C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe File opened for modification C:\Windows\SysWOW64\wnpkm2.exe wnpkm2.exe -
Suspicious use of SetThreadContext 25 IoCs
description pid Process procid_target PID 4560 set thread context of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 3264 set thread context of 4968 3264 wnpkm2.exe 84 PID 4828 set thread context of 1116 4828 wnpkm2.exe 92 PID 3176 set thread context of 3852 3176 wnpkm2.exe 96 PID 4856 set thread context of 3468 4856 wnpkm2.exe 98 PID 4600 set thread context of 3240 4600 wnpkm2.exe 101 PID 2736 set thread context of 4136 2736 wnpkm2.exe 104 PID 4452 set thread context of 2952 4452 wnpkm2.exe 106 PID 1352 set thread context of 2432 1352 wnpkm2.exe 108 PID 4312 set thread context of 3736 4312 wnpkm2.exe 110 PID 3044 set thread context of 1188 3044 wnpkm2.exe 112 PID 4836 set thread context of 4280 4836 wnpkm2.exe 114 PID 4764 set thread context of 1060 4764 wnpkm2.exe 116 PID 4112 set thread context of 2444 4112 wnpkm2.exe 118 PID 1040 set thread context of 3456 1040 wnpkm2.exe 120 PID 4800 set thread context of 4552 4800 wnpkm2.exe 122 PID 852 set thread context of 4988 852 wnpkm2.exe 124 PID 4464 set thread context of 2068 4464 wnpkm2.exe 126 PID 3000 set thread context of 2988 3000 wnpkm2.exe 128 PID 3616 set thread context of 4912 3616 wnpkm2.exe 130 PID 4244 set thread context of 4952 4244 wnpkm2.exe 132 PID 2564 set thread context of 3572 2564 wnpkm2.exe 134 PID 2328 set thread context of 1068 2328 wnpkm2.exe 136 PID 1960 set thread context of 3688 1960 wnpkm2.exe 138 PID 2748 set thread context of 2556 2748 wnpkm2.exe 140 -
resource yara_rule behavioral2/memory/4784-0-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4784-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4784-3-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4784-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4784-37-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4968-43-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4968-46-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4968-45-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4968-44-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4968-48-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1116-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1116-53-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1116-55-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3852-60-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3852-59-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3852-61-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3852-63-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3468-71-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3240-77-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4136-84-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4136-85-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2952-93-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2432-98-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2432-101-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3736-106-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3736-109-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1188-114-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1188-118-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4280-123-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4280-126-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1060-131-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1060-136-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2444-140-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2444-146-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3456-151-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3456-155-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4552-159-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4552-165-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4988-173-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2068-181-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2988-190-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4912-198-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4952-206-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3572-214-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1068-221-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3688-230-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 50 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpkm2.exe -
Modifies registry class 50 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpkm2.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4784 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 4784 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 4968 wnpkm2.exe 4968 wnpkm2.exe 1116 wnpkm2.exe 1116 wnpkm2.exe 3852 wnpkm2.exe 3852 wnpkm2.exe 3468 wnpkm2.exe 3468 wnpkm2.exe 3240 wnpkm2.exe 3240 wnpkm2.exe 4136 wnpkm2.exe 4136 wnpkm2.exe 2952 wnpkm2.exe 2952 wnpkm2.exe 2432 wnpkm2.exe 2432 wnpkm2.exe 3736 wnpkm2.exe 3736 wnpkm2.exe 1188 wnpkm2.exe 1188 wnpkm2.exe 4280 wnpkm2.exe 4280 wnpkm2.exe 1060 wnpkm2.exe 1060 wnpkm2.exe 2444 wnpkm2.exe 2444 wnpkm2.exe 3456 wnpkm2.exe 3456 wnpkm2.exe 4552 wnpkm2.exe 4552 wnpkm2.exe 4988 wnpkm2.exe 4988 wnpkm2.exe 2068 wnpkm2.exe 2068 wnpkm2.exe 2988 wnpkm2.exe 2988 wnpkm2.exe 4912 wnpkm2.exe 4912 wnpkm2.exe 4952 wnpkm2.exe 4952 wnpkm2.exe 3572 wnpkm2.exe 3572 wnpkm2.exe 1068 wnpkm2.exe 1068 wnpkm2.exe 3688 wnpkm2.exe 3688 wnpkm2.exe 2556 wnpkm2.exe 2556 wnpkm2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4560 wrote to memory of 4784 4560 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 82 PID 4784 wrote to memory of 3264 4784 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 83 PID 4784 wrote to memory of 3264 4784 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 83 PID 4784 wrote to memory of 3264 4784 90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe 83 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 3264 wrote to memory of 4968 3264 wnpkm2.exe 84 PID 4968 wrote to memory of 4828 4968 wnpkm2.exe 91 PID 4968 wrote to memory of 4828 4968 wnpkm2.exe 91 PID 4968 wrote to memory of 4828 4968 wnpkm2.exe 91 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 4828 wrote to memory of 1116 4828 wnpkm2.exe 92 PID 1116 wrote to memory of 3176 1116 wnpkm2.exe 95 PID 1116 wrote to memory of 3176 1116 wnpkm2.exe 95 PID 1116 wrote to memory of 3176 1116 wnpkm2.exe 95 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3176 wrote to memory of 3852 3176 wnpkm2.exe 96 PID 3852 wrote to memory of 4856 3852 wnpkm2.exe 97 PID 3852 wrote to memory of 4856 3852 wnpkm2.exe 97 PID 3852 wrote to memory of 4856 3852 wnpkm2.exe 97 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 4856 wrote to memory of 3468 4856 wnpkm2.exe 98 PID 3468 wrote to memory of 4600 3468 wnpkm2.exe 99 PID 3468 wrote to memory of 4600 3468 wnpkm2.exe 99 PID 3468 wrote to memory of 4600 3468 wnpkm2.exe 99 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 4600 wrote to memory of 3240 4600 wnpkm2.exe 101 PID 3240 wrote to memory of 2736 3240 wnpkm2.exe 103 PID 3240 wrote to memory of 2736 3240 wnpkm2.exe 103 PID 3240 wrote to memory of 2736 3240 wnpkm2.exe 103 PID 2736 wrote to memory of 4136 2736 wnpkm2.exe 104 PID 2736 wrote to memory of 4136 2736 wnpkm2.exe 104 PID 2736 wrote to memory of 4136 2736 wnpkm2.exe 104 PID 2736 wrote to memory of 4136 2736 wnpkm2.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90df2ee61b9f57b1f9a84fbfe7229956_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Users\Admin\AppData\Local\Temp\90DF2E~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Users\Admin\AppData\Local\Temp\90DF2E~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4136 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4452 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2952 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1352 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4312 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3736 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3044 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1188 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4836 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4280 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4764 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1060 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4112 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1040 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3456 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4800 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4552 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:852 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4988 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4464 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3000 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2988 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3616 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4912 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4244 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2564 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2328 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1960 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3688 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2748 -
C:\Windows\SysWOW64\wnpkm2.exe"C:\Windows\system32\wnpkm2.exe" C:\Windows\SysWOW64\wnpkm2.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD590df2ee61b9f57b1f9a84fbfe7229956
SHA12a7661c18a53a803e70f4b240d6cbf65f5da877e
SHA256e16633a047908f513cbdcb2fb3a11768c0477bd71a47f59ad4fb745b6718016c
SHA51243c6acefc7fab1fbfc0f28e858b223e6635b13dcf12416893f1f432d51f0da84866d8bb22dea9d9d441258a50f90e66efdff068e5f615622c9c6be6cbe719249