Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe
-
Size
149KB
-
MD5
d1b8900805471d9d106ccf8651bbf8ad
-
SHA1
acf8b4c425d0db4e52c9833003dc29cc74a583bf
-
SHA256
f350e00e97d748de5e1595792cc07c99407627072cca7fe8bd978dd16239e3a9
-
SHA512
e22e89e897fb7f777b4636e8b14029a75a66e741e8dc8728fe43897719ec06711cc6a5ceef8b82ccae096b0b537381d18a2567fc59aabfeac0a8777bca73176a
-
SSDEEP
3072:9CVkpg1OuoltBjPtwkDPkp+0maXtu5yv70Lec7cL3SUZrK373o:9QsflDjtwQMVtuk70Le1S2ao
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation wmisrmgi.exe -
Deletes itself 1 IoCs
pid Process 2188 wmisrmgi.exe -
Executes dropped EXE 60 IoCs
pid Process 2020 wmisrmgi.exe 2188 wmisrmgi.exe 2616 wmisrmgi.exe 3100 wmisrmgi.exe 4088 wmisrmgi.exe 1496 wmisrmgi.exe 1648 wmisrmgi.exe 2864 wmisrmgi.exe 1204 wmisrmgi.exe 2560 wmisrmgi.exe 4276 wmisrmgi.exe 4280 wmisrmgi.exe 2256 wmisrmgi.exe 3040 wmisrmgi.exe 2312 wmisrmgi.exe 1500 wmisrmgi.exe 3500 wmisrmgi.exe 4796 wmisrmgi.exe 4052 wmisrmgi.exe 3884 wmisrmgi.exe 1096 wmisrmgi.exe 3712 wmisrmgi.exe 384 wmisrmgi.exe 4556 wmisrmgi.exe 4956 wmisrmgi.exe 2436 wmisrmgi.exe 5044 wmisrmgi.exe 5080 wmisrmgi.exe 2964 wmisrmgi.exe 4120 wmisrmgi.exe 1348 wmisrmgi.exe 616 wmisrmgi.exe 2024 wmisrmgi.exe 2072 wmisrmgi.exe 5112 wmisrmgi.exe 2084 wmisrmgi.exe 1188 wmisrmgi.exe 3064 wmisrmgi.exe 4564 wmisrmgi.exe 456 wmisrmgi.exe 1424 wmisrmgi.exe 4680 wmisrmgi.exe 1736 wmisrmgi.exe 1512 wmisrmgi.exe 4460 wmisrmgi.exe 3084 wmisrmgi.exe 1520 wmisrmgi.exe 1148 wmisrmgi.exe 1940 wmisrmgi.exe 3264 wmisrmgi.exe 4088 wmisrmgi.exe 4172 wmisrmgi.exe 4476 wmisrmgi.exe 5028 wmisrmgi.exe 2444 wmisrmgi.exe 4568 wmisrmgi.exe 428 wmisrmgi.exe 4700 wmisrmgi.exe 540 wmisrmgi.exe 4140 wmisrmgi.exe -
Maps connected drives based on registry 3 TTPs 62 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmisrmgi.exe -
Drops file in System32 directory 60 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmisrmgi.exe d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File opened for modification C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe File created C:\Windows\SysWOW64\wmisrmgi.exe wmisrmgi.exe -
Suspicious use of SetThreadContext 31 IoCs
description pid Process procid_target PID 4508 set thread context of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 2020 set thread context of 2188 2020 wmisrmgi.exe 86 PID 2616 set thread context of 3100 2616 wmisrmgi.exe 92 PID 4088 set thread context of 1496 4088 wmisrmgi.exe 98 PID 1648 set thread context of 2864 1648 wmisrmgi.exe 104 PID 1204 set thread context of 2560 1204 wmisrmgi.exe 106 PID 4276 set thread context of 4280 4276 wmisrmgi.exe 108 PID 2256 set thread context of 3040 2256 wmisrmgi.exe 113 PID 2312 set thread context of 1500 2312 wmisrmgi.exe 115 PID 3500 set thread context of 4796 3500 wmisrmgi.exe 117 PID 4052 set thread context of 3884 4052 wmisrmgi.exe 119 PID 1096 set thread context of 3712 1096 wmisrmgi.exe 121 PID 384 set thread context of 4556 384 wmisrmgi.exe 123 PID 4956 set thread context of 2436 4956 wmisrmgi.exe 126 PID 5044 set thread context of 5080 5044 wmisrmgi.exe 128 PID 2964 set thread context of 4120 2964 wmisrmgi.exe 130 PID 1348 set thread context of 616 1348 wmisrmgi.exe 132 PID 2024 set thread context of 2072 2024 wmisrmgi.exe 134 PID 5112 set thread context of 2084 5112 wmisrmgi.exe 136 PID 1188 set thread context of 3064 1188 wmisrmgi.exe 138 PID 4564 set thread context of 456 4564 wmisrmgi.exe 140 PID 1424 set thread context of 4680 1424 wmisrmgi.exe 142 PID 1736 set thread context of 1512 1736 wmisrmgi.exe 144 PID 4460 set thread context of 3084 4460 wmisrmgi.exe 146 PID 1520 set thread context of 1148 1520 wmisrmgi.exe 148 PID 1940 set thread context of 3264 1940 wmisrmgi.exe 150 PID 4088 set thread context of 4172 4088 wmisrmgi.exe 152 PID 4476 set thread context of 5028 4476 wmisrmgi.exe 154 PID 2444 set thread context of 4568 2444 wmisrmgi.exe 156 PID 428 set thread context of 4700 428 wmisrmgi.exe 158 PID 540 set thread context of 4140 540 wmisrmgi.exe 160 -
resource yara_rule behavioral2/memory/2400-0-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2400-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2400-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2400-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2400-38-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2188-44-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2188-47-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3100-53-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3100-55-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1496-62-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2864-69-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2560-76-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4280-83-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3040-90-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1500-96-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4796-103-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3884-111-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3712-118-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4556-127-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2436-136-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/5080-144-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4120-152-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/616-160-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2072-168-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2084-176-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3064-184-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/456-188-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/456-193-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4680-202-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1512-209-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3084-215-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1148-221-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3264-227-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4172-233-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/5028-239-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4568-245-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4700-251-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmisrmgi.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmisrmgi.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2400 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 2400 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 2188 wmisrmgi.exe 2188 wmisrmgi.exe 3100 wmisrmgi.exe 3100 wmisrmgi.exe 1496 wmisrmgi.exe 1496 wmisrmgi.exe 2864 wmisrmgi.exe 2864 wmisrmgi.exe 2560 wmisrmgi.exe 2560 wmisrmgi.exe 4280 wmisrmgi.exe 4280 wmisrmgi.exe 3040 wmisrmgi.exe 3040 wmisrmgi.exe 1500 wmisrmgi.exe 1500 wmisrmgi.exe 4796 wmisrmgi.exe 4796 wmisrmgi.exe 3884 wmisrmgi.exe 3884 wmisrmgi.exe 3712 wmisrmgi.exe 3712 wmisrmgi.exe 4556 wmisrmgi.exe 4556 wmisrmgi.exe 2436 wmisrmgi.exe 2436 wmisrmgi.exe 5080 wmisrmgi.exe 5080 wmisrmgi.exe 4120 wmisrmgi.exe 4120 wmisrmgi.exe 616 wmisrmgi.exe 616 wmisrmgi.exe 2072 wmisrmgi.exe 2072 wmisrmgi.exe 2084 wmisrmgi.exe 2084 wmisrmgi.exe 3064 wmisrmgi.exe 3064 wmisrmgi.exe 456 wmisrmgi.exe 456 wmisrmgi.exe 4680 wmisrmgi.exe 4680 wmisrmgi.exe 1512 wmisrmgi.exe 1512 wmisrmgi.exe 3084 wmisrmgi.exe 3084 wmisrmgi.exe 1148 wmisrmgi.exe 1148 wmisrmgi.exe 3264 wmisrmgi.exe 3264 wmisrmgi.exe 4172 wmisrmgi.exe 4172 wmisrmgi.exe 5028 wmisrmgi.exe 5028 wmisrmgi.exe 4568 wmisrmgi.exe 4568 wmisrmgi.exe 4700 wmisrmgi.exe 4700 wmisrmgi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 4508 wrote to memory of 2400 4508 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 83 PID 2400 wrote to memory of 2020 2400 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 85 PID 2400 wrote to memory of 2020 2400 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 85 PID 2400 wrote to memory of 2020 2400 d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe 85 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2020 wrote to memory of 2188 2020 wmisrmgi.exe 86 PID 2188 wrote to memory of 2616 2188 wmisrmgi.exe 89 PID 2188 wrote to memory of 2616 2188 wmisrmgi.exe 89 PID 2188 wrote to memory of 2616 2188 wmisrmgi.exe 89 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 2616 wrote to memory of 3100 2616 wmisrmgi.exe 92 PID 3100 wrote to memory of 4088 3100 wmisrmgi.exe 97 PID 3100 wrote to memory of 4088 3100 wmisrmgi.exe 97 PID 3100 wrote to memory of 4088 3100 wmisrmgi.exe 97 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 4088 wrote to memory of 1496 4088 wmisrmgi.exe 98 PID 1496 wrote to memory of 1648 1496 wmisrmgi.exe 103 PID 1496 wrote to memory of 1648 1496 wmisrmgi.exe 103 PID 1496 wrote to memory of 1648 1496 wmisrmgi.exe 103 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 1648 wrote to memory of 2864 1648 wmisrmgi.exe 104 PID 2864 wrote to memory of 1204 2864 wmisrmgi.exe 105 PID 2864 wrote to memory of 1204 2864 wmisrmgi.exe 105 PID 2864 wrote to memory of 1204 2864 wmisrmgi.exe 105 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 1204 wrote to memory of 2560 1204 wmisrmgi.exe 106 PID 2560 wrote to memory of 4276 2560 wmisrmgi.exe 107 PID 2560 wrote to memory of 4276 2560 wmisrmgi.exe 107 PID 2560 wrote to memory of 4276 2560 wmisrmgi.exe 107 PID 4276 wrote to memory of 4280 4276 wmisrmgi.exe 108 PID 4276 wrote to memory of 4280 4276 wmisrmgi.exe 108 PID 4276 wrote to memory of 4280 4276 wmisrmgi.exe 108 PID 4276 wrote to memory of 4280 4276 wmisrmgi.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b8900805471d9d106ccf8651bbf8ad_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Users\Admin\AppData\Local\Temp\D1B890~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Users\Admin\AppData\Local\Temp\D1B890~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4280 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3040 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1500 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4796 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4052 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3884 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3712 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:384 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4556 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2436 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5080 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4120 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:616 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2072 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1188 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:456 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1424 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4680 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3084 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1148 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1940 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3264 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4088 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4172 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5028 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4568 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:428 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4700 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\system32\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\wmisrmgi.exe"C:\Windows\SysWOW64\wmisrmgi.exe" C:\Windows\SysWOW64\wmisrmgi.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:4140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD5d1b8900805471d9d106ccf8651bbf8ad
SHA1acf8b4c425d0db4e52c9833003dc29cc74a583bf
SHA256f350e00e97d748de5e1595792cc07c99407627072cca7fe8bd978dd16239e3a9
SHA512e22e89e897fb7f777b4636e8b14029a75a66e741e8dc8728fe43897719ec06711cc6a5ceef8b82ccae096b0b537381d18a2567fc59aabfeac0a8777bca73176a