Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe
-
Size
120KB
-
MD5
d44f4ced83e4bcd7ee0d90abeb73c2a4
-
SHA1
59b3afe0208f533ed727c0f949d5fd15b0529f60
-
SHA256
ca6dd71f871e058ed817ac5924fefee978cc9f9035f9950d61d5df5f9638e417
-
SHA512
da8cdfcd2cb5cdc70489e23f1db9a6913e4188b7f15b3ae6873e8ff0ccdd92fd2cc7fe50cded0d2894c98640a16dea7188d5fe560e37a2256403324eb2c92460
-
SSDEEP
3072:VQVnnBz6UdEXT1J4ImFVgdyYxXwqD5j8AFWQ1RWUDXPz7+W:VQVnBz/d1s0cXwu5YGV1AuWW
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 28 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation wnptd1.exe -
Deletes itself 1 IoCs
pid Process 3264 wnptd1.exe -
Executes dropped EXE 56 IoCs
pid Process 2996 wnptd1.exe 3264 wnptd1.exe 3608 wnptd1.exe 5052 wnptd1.exe 2876 wnptd1.exe 4300 wnptd1.exe 1620 wnptd1.exe 3452 wnptd1.exe 1848 wnptd1.exe 2556 wnptd1.exe 3456 wnptd1.exe 2224 wnptd1.exe 2840 wnptd1.exe 1360 wnptd1.exe 4328 wnptd1.exe 2288 wnptd1.exe 2916 wnptd1.exe 1376 wnptd1.exe 1124 wnptd1.exe 2912 wnptd1.exe 5024 wnptd1.exe 460 wnptd1.exe 1964 wnptd1.exe 4052 wnptd1.exe 2952 wnptd1.exe 1948 wnptd1.exe 1312 wnptd1.exe 2640 wnptd1.exe 2132 wnptd1.exe 3328 wnptd1.exe 3632 wnptd1.exe 3572 wnptd1.exe 2792 wnptd1.exe 1092 wnptd1.exe 1068 wnptd1.exe 5012 wnptd1.exe 540 wnptd1.exe 1872 wnptd1.exe 4140 wnptd1.exe 2772 wnptd1.exe 4312 wnptd1.exe 4328 wnptd1.exe 4420 wnptd1.exe 2004 wnptd1.exe 1708 wnptd1.exe 2364 wnptd1.exe 4488 wnptd1.exe 4728 wnptd1.exe 4100 wnptd1.exe 2660 wnptd1.exe 2512 wnptd1.exe 2824 wnptd1.exe 3896 wnptd1.exe 1536 wnptd1.exe 4584 wnptd1.exe 760 wnptd1.exe -
Maps connected drives based on registry 3 TTPs 58 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnptd1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnptd1.exe -
Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File opened for modification C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe File created C:\Windows\SysWOW64\wnptd1.exe wnptd1.exe -
Suspicious use of SetThreadContext 29 IoCs
description pid Process procid_target PID 2068 set thread context of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2996 set thread context of 3264 2996 wnptd1.exe 85 PID 3608 set thread context of 5052 3608 wnptd1.exe 87 PID 2876 set thread context of 4300 2876 wnptd1.exe 94 PID 1620 set thread context of 3452 1620 wnptd1.exe 98 PID 1848 set thread context of 2556 1848 wnptd1.exe 104 PID 3456 set thread context of 2224 3456 wnptd1.exe 108 PID 2840 set thread context of 1360 2840 wnptd1.exe 111 PID 4328 set thread context of 2288 4328 wnptd1.exe 113 PID 2916 set thread context of 1376 2916 wnptd1.exe 115 PID 1124 set thread context of 2912 1124 wnptd1.exe 117 PID 5024 set thread context of 460 5024 wnptd1.exe 119 PID 1964 set thread context of 4052 1964 wnptd1.exe 121 PID 2952 set thread context of 1948 2952 wnptd1.exe 123 PID 1312 set thread context of 2640 1312 wnptd1.exe 125 PID 2132 set thread context of 3328 2132 wnptd1.exe 127 PID 3632 set thread context of 3572 3632 wnptd1.exe 129 PID 2792 set thread context of 1092 2792 wnptd1.exe 131 PID 1068 set thread context of 5012 1068 wnptd1.exe 133 PID 540 set thread context of 1872 540 wnptd1.exe 135 PID 4140 set thread context of 2772 4140 wnptd1.exe 137 PID 4312 set thread context of 4328 4312 wnptd1.exe 139 PID 4420 set thread context of 2004 4420 wnptd1.exe 141 PID 1708 set thread context of 2364 1708 wnptd1.exe 143 PID 4488 set thread context of 4728 4488 wnptd1.exe 145 PID 4100 set thread context of 2660 4100 wnptd1.exe 147 PID 2512 set thread context of 2824 2512 wnptd1.exe 149 PID 3896 set thread context of 1536 3896 wnptd1.exe 151 PID 4584 set thread context of 760 4584 wnptd1.exe 153 -
resource yara_rule behavioral2/memory/4352-0-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4352-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4352-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4352-3-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4352-40-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3264-44-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3264-45-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3264-46-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3264-48-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/5052-52-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/5052-53-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/5052-54-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4300-59-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4300-60-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4300-62-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3452-66-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3452-67-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3452-69-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2556-73-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2556-74-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2556-76-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2224-84-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1360-91-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2288-97-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1376-105-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2912-114-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/460-119-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4052-129-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1948-137-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2640-145-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3328-154-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3572-162-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1092-171-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/5012-179-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1872-187-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2772-196-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4328-204-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2004-212-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2364-219-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4728-225-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2660-231-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2824-237-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1536-243-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 57 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnptd1.exe -
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnptd1.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4352 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 4352 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 3264 wnptd1.exe 3264 wnptd1.exe 5052 wnptd1.exe 5052 wnptd1.exe 4300 wnptd1.exe 4300 wnptd1.exe 3452 wnptd1.exe 3452 wnptd1.exe 2556 wnptd1.exe 2556 wnptd1.exe 2224 wnptd1.exe 2224 wnptd1.exe 1360 wnptd1.exe 1360 wnptd1.exe 2288 wnptd1.exe 2288 wnptd1.exe 1376 wnptd1.exe 1376 wnptd1.exe 2912 wnptd1.exe 2912 wnptd1.exe 460 wnptd1.exe 460 wnptd1.exe 4052 wnptd1.exe 4052 wnptd1.exe 1948 wnptd1.exe 1948 wnptd1.exe 2640 wnptd1.exe 2640 wnptd1.exe 3328 wnptd1.exe 3328 wnptd1.exe 3572 wnptd1.exe 3572 wnptd1.exe 1092 wnptd1.exe 1092 wnptd1.exe 5012 wnptd1.exe 5012 wnptd1.exe 1872 wnptd1.exe 1872 wnptd1.exe 2772 wnptd1.exe 2772 wnptd1.exe 4328 wnptd1.exe 4328 wnptd1.exe 2004 wnptd1.exe 2004 wnptd1.exe 2364 wnptd1.exe 2364 wnptd1.exe 4728 wnptd1.exe 4728 wnptd1.exe 2660 wnptd1.exe 2660 wnptd1.exe 2824 wnptd1.exe 2824 wnptd1.exe 1536 wnptd1.exe 1536 wnptd1.exe 760 wnptd1.exe 760 wnptd1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 2068 wrote to memory of 4352 2068 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 83 PID 4352 wrote to memory of 2996 4352 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 84 PID 4352 wrote to memory of 2996 4352 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 84 PID 4352 wrote to memory of 2996 4352 d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe 84 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 2996 wrote to memory of 3264 2996 wnptd1.exe 85 PID 3264 wrote to memory of 3608 3264 wnptd1.exe 86 PID 3264 wrote to memory of 3608 3264 wnptd1.exe 86 PID 3264 wrote to memory of 3608 3264 wnptd1.exe 86 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 3608 wrote to memory of 5052 3608 wnptd1.exe 87 PID 5052 wrote to memory of 2876 5052 wnptd1.exe 92 PID 5052 wrote to memory of 2876 5052 wnptd1.exe 92 PID 5052 wrote to memory of 2876 5052 wnptd1.exe 92 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 2876 wrote to memory of 4300 2876 wnptd1.exe 94 PID 4300 wrote to memory of 1620 4300 wnptd1.exe 97 PID 4300 wrote to memory of 1620 4300 wnptd1.exe 97 PID 4300 wrote to memory of 1620 4300 wnptd1.exe 97 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 1620 wrote to memory of 3452 1620 wnptd1.exe 98 PID 3452 wrote to memory of 1848 3452 wnptd1.exe 103 PID 3452 wrote to memory of 1848 3452 wnptd1.exe 103 PID 3452 wrote to memory of 1848 3452 wnptd1.exe 103 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 1848 wrote to memory of 2556 1848 wnptd1.exe 104 PID 2556 wrote to memory of 3456 2556 wnptd1.exe 107 PID 2556 wrote to memory of 3456 2556 wnptd1.exe 107 PID 2556 wrote to memory of 3456 2556 wnptd1.exe 107 PID 3456 wrote to memory of 2224 3456 wnptd1.exe 108 PID 3456 wrote to memory of 2224 3456 wnptd1.exe 108 PID 3456 wrote to memory of 2224 3456 wnptd1.exe 108 PID 3456 wrote to memory of 2224 3456 wnptd1.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d44f4ced83e4bcd7ee0d90abeb73c2a4_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Users\Admin\AppData\Local\Temp\D44F4C~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Users\Admin\AppData\Local\Temp\D44F4C~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1360 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2288 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2912 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:460 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4052 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1948 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2640 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3328 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3632 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1092 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5012 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1872 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4728 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2824 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\wnptd1.exe"C:\Windows\system32\wnptd1.exe" C:\Windows\SysWOW64\wnptd1.exe58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5d44f4ced83e4bcd7ee0d90abeb73c2a4
SHA159b3afe0208f533ed727c0f949d5fd15b0529f60
SHA256ca6dd71f871e058ed817ac5924fefee978cc9f9035f9950d61d5df5f9638e417
SHA512da8cdfcd2cb5cdc70489e23f1db9a6913e4188b7f15b3ae6873e8ff0ccdd92fd2cc7fe50cded0d2894c98640a16dea7188d5fe560e37a2256403324eb2c92460