Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2024 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe
-
Size
148KB
-
MD5
c8dd59bf73522b33879f3cce5f828e57
-
SHA1
8c222824892af3e65d5f1592b184cefd381edb0b
-
SHA256
eda35a3e0bfcc40a8bf7346284b7abc4e32c0bd5f9132c92a41255923e1c794b
-
SHA512
c08e9d79b2b8c85f6adb0d83303c1b14ca47b3ba40c2a0545e919e5d4085e26bc91a413e36bc84ea7b38c5591047237b4a2598b89dda57b61d3edd2eebbdd8ee
-
SSDEEP
3072:e9zPtsX9MmgRfE33SufwpxhcRPFZK7pIC23TbZ31M1CGt0soMz:HXSlRfEnTMxhzpx2jvM/MU
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 27 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation wnpdx3.exe -
Deletes itself 1 IoCs
pid Process 3252 wnpdx3.exe -
Executes dropped EXE 54 IoCs
pid Process 1044 wnpdx3.exe 3252 wnpdx3.exe 5028 wnpdx3.exe 1512 wnpdx3.exe 2328 wnpdx3.exe 732 wnpdx3.exe 3540 wnpdx3.exe 4124 wnpdx3.exe 4544 wnpdx3.exe 1088 wnpdx3.exe 4548 wnpdx3.exe 3908 wnpdx3.exe 1392 wnpdx3.exe 740 wnpdx3.exe 2396 wnpdx3.exe 2812 wnpdx3.exe 2188 wnpdx3.exe 4264 wnpdx3.exe 4708 wnpdx3.exe 1772 wnpdx3.exe 812 wnpdx3.exe 1380 wnpdx3.exe 1888 wnpdx3.exe 4012 wnpdx3.exe 992 wnpdx3.exe 3676 wnpdx3.exe 4216 wnpdx3.exe 4660 wnpdx3.exe 3892 wnpdx3.exe 2280 wnpdx3.exe 1960 wnpdx3.exe 3920 wnpdx3.exe 3488 wnpdx3.exe 4840 wnpdx3.exe 2936 wnpdx3.exe 804 wnpdx3.exe 3320 wnpdx3.exe 4852 wnpdx3.exe 3292 wnpdx3.exe 5088 wnpdx3.exe 2512 wnpdx3.exe 2980 wnpdx3.exe 2716 wnpdx3.exe 2256 wnpdx3.exe 2304 wnpdx3.exe 720 wnpdx3.exe 4892 wnpdx3.exe 4964 wnpdx3.exe 1744 wnpdx3.exe 664 wnpdx3.exe 4524 wnpdx3.exe 2248 wnpdx3.exe 2724 wnpdx3.exe 1576 wnpdx3.exe -
Maps connected drives based on registry 3 TTPs 56 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpdx3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpdx3.exe -
Drops file in System32 directory 52 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File created C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe File opened for modification C:\Windows\SysWOW64\wnpdx3.exe wnpdx3.exe -
Suspicious use of SetThreadContext 28 IoCs
description pid Process procid_target PID 2880 set thread context of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 1044 set thread context of 3252 1044 wnpdx3.exe 91 PID 5028 set thread context of 1512 5028 wnpdx3.exe 97 PID 2328 set thread context of 732 2328 wnpdx3.exe 103 PID 3540 set thread context of 4124 3540 wnpdx3.exe 105 PID 4544 set thread context of 1088 4544 wnpdx3.exe 107 PID 4548 set thread context of 3908 4548 wnpdx3.exe 112 PID 1392 set thread context of 740 1392 wnpdx3.exe 114 PID 2396 set thread context of 2812 2396 wnpdx3.exe 116 PID 2188 set thread context of 4264 2188 wnpdx3.exe 118 PID 4708 set thread context of 1772 4708 wnpdx3.exe 120 PID 812 set thread context of 1380 812 wnpdx3.exe 122 PID 1888 set thread context of 4012 1888 wnpdx3.exe 125 PID 992 set thread context of 3676 992 wnpdx3.exe 127 PID 4216 set thread context of 4660 4216 wnpdx3.exe 129 PID 3892 set thread context of 2280 3892 wnpdx3.exe 131 PID 1960 set thread context of 3920 1960 wnpdx3.exe 133 PID 3488 set thread context of 4840 3488 wnpdx3.exe 135 PID 2936 set thread context of 804 2936 wnpdx3.exe 137 PID 3320 set thread context of 4852 3320 wnpdx3.exe 139 PID 3292 set thread context of 5088 3292 wnpdx3.exe 141 PID 2512 set thread context of 2980 2512 wnpdx3.exe 143 PID 2716 set thread context of 2256 2716 wnpdx3.exe 145 PID 2304 set thread context of 720 2304 wnpdx3.exe 147 PID 4892 set thread context of 4964 4892 wnpdx3.exe 149 PID 1744 set thread context of 664 1744 wnpdx3.exe 151 PID 4524 set thread context of 2248 4524 wnpdx3.exe 153 PID 2724 set thread context of 1576 2724 wnpdx3.exe 155 -
resource yara_rule behavioral2/memory/3896-4-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3896-3-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3896-2-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3896-0-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3896-37-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3252-46-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3252-45-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3252-44-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3252-43-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3252-47-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1512-55-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/732-62-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4124-69-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1088-77-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3908-83-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/740-91-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2812-98-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4264-105-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1772-111-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1380-119-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4012-128-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3676-136-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4660-144-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2280-152-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3920-160-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4840-168-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/804-174-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4852-183-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/5088-191-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2980-199-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2256-207-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/720-213-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/4964-219-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/664-225-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/2248-231-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 55 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpdx3.exe -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpdx3.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3896 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 3896 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 3252 wnpdx3.exe 3252 wnpdx3.exe 1512 wnpdx3.exe 1512 wnpdx3.exe 732 wnpdx3.exe 732 wnpdx3.exe 4124 wnpdx3.exe 4124 wnpdx3.exe 1088 wnpdx3.exe 1088 wnpdx3.exe 3908 wnpdx3.exe 3908 wnpdx3.exe 740 wnpdx3.exe 740 wnpdx3.exe 2812 wnpdx3.exe 2812 wnpdx3.exe 4264 wnpdx3.exe 4264 wnpdx3.exe 1772 wnpdx3.exe 1772 wnpdx3.exe 1380 wnpdx3.exe 1380 wnpdx3.exe 4012 wnpdx3.exe 4012 wnpdx3.exe 3676 wnpdx3.exe 3676 wnpdx3.exe 4660 wnpdx3.exe 4660 wnpdx3.exe 2280 wnpdx3.exe 2280 wnpdx3.exe 3920 wnpdx3.exe 3920 wnpdx3.exe 4840 wnpdx3.exe 4840 wnpdx3.exe 4852 wnpdx3.exe 4852 wnpdx3.exe 5088 wnpdx3.exe 5088 wnpdx3.exe 2980 wnpdx3.exe 2980 wnpdx3.exe 2256 wnpdx3.exe 2256 wnpdx3.exe 720 wnpdx3.exe 720 wnpdx3.exe 4964 wnpdx3.exe 4964 wnpdx3.exe 664 wnpdx3.exe 664 wnpdx3.exe 2248 wnpdx3.exe 2248 wnpdx3.exe 1576 wnpdx3.exe 1576 wnpdx3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 2880 wrote to memory of 3896 2880 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 83 PID 3896 wrote to memory of 1044 3896 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 88 PID 3896 wrote to memory of 1044 3896 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 88 PID 3896 wrote to memory of 1044 3896 c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe 88 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 1044 wrote to memory of 3252 1044 wnpdx3.exe 91 PID 3252 wrote to memory of 5028 3252 wnpdx3.exe 96 PID 3252 wrote to memory of 5028 3252 wnpdx3.exe 96 PID 3252 wrote to memory of 5028 3252 wnpdx3.exe 96 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 5028 wrote to memory of 1512 5028 wnpdx3.exe 97 PID 1512 wrote to memory of 2328 1512 wnpdx3.exe 102 PID 1512 wrote to memory of 2328 1512 wnpdx3.exe 102 PID 1512 wrote to memory of 2328 1512 wnpdx3.exe 102 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 2328 wrote to memory of 732 2328 wnpdx3.exe 103 PID 732 wrote to memory of 3540 732 wnpdx3.exe 104 PID 732 wrote to memory of 3540 732 wnpdx3.exe 104 PID 732 wrote to memory of 3540 732 wnpdx3.exe 104 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 3540 wrote to memory of 4124 3540 wnpdx3.exe 105 PID 4124 wrote to memory of 4544 4124 wnpdx3.exe 106 PID 4124 wrote to memory of 4544 4124 wnpdx3.exe 106 PID 4124 wrote to memory of 4544 4124 wnpdx3.exe 106 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 4544 wrote to memory of 1088 4544 wnpdx3.exe 107 PID 1088 wrote to memory of 4548 1088 wnpdx3.exe 111 PID 1088 wrote to memory of 4548 1088 wnpdx3.exe 111 PID 1088 wrote to memory of 4548 1088 wnpdx3.exe 111 PID 4548 wrote to memory of 3908 4548 wnpdx3.exe 112 PID 4548 wrote to memory of 3908 4548 wnpdx3.exe 112 PID 4548 wrote to memory of 3908 4548 wnpdx3.exe 112 PID 4548 wrote to memory of 3908 4548 wnpdx3.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8dd59bf73522b33879f3cce5f828e57_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Users\Admin\AppData\Local\Temp\C8DD59~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Users\Admin\AppData\Local\Temp\C8DD59~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3908 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:740 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4264 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1772 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:812 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1380 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4012 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3676 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3920 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4840 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:804 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4852 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5088 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2256 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:720 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4964 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:664 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\wnpdx3.exe"C:\Windows\system32\wnpdx3.exe" C:\Windows\SysWOW64\wnpdx3.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5c8dd59bf73522b33879f3cce5f828e57
SHA18c222824892af3e65d5f1592b184cefd381edb0b
SHA256eda35a3e0bfcc40a8bf7346284b7abc4e32c0bd5f9132c92a41255923e1c794b
SHA512c08e9d79b2b8c85f6adb0d83303c1b14ca47b3ba40c2a0545e919e5d4085e26bc91a413e36bc84ea7b38c5591047237b4a2598b89dda57b61d3edd2eebbdd8ee