Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe
-
Size
140KB
-
MD5
dbb207f2e80c2dfed39597a40539bd9b
-
SHA1
1409ec7f6a72e167c2353a5800cf1d47eceef7d0
-
SHA256
c5b4a36ebdb894e55eb1a0ce991ea8e4e72d86d0945977b892831d7d96d358e9
-
SHA512
a50aa1af17fc47b8fef2100207c20a3ad65e689430b76b8f4646c7021306d7c86d86a24307a999b66f252a954a912addd676375d0d778393e063a5fce77ed310
-
SSDEEP
3072:sYKGtWxuFs4Hx+vQBPjP6JAhHaD3y6PEEVAkPNJX7fqg1:aG8x67xDBPL6J2HaDbJ71
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 27 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation wnpxv2.exe -
Deletes itself 1 IoCs
pid Process 2964 wnpxv2.exe -
Executes dropped EXE 54 IoCs
pid Process 1924 wnpxv2.exe 2964 wnpxv2.exe 3068 wnpxv2.exe 936 wnpxv2.exe 5112 wnpxv2.exe 740 wnpxv2.exe 1224 wnpxv2.exe 2272 wnpxv2.exe 1860 wnpxv2.exe 4000 wnpxv2.exe 768 wnpxv2.exe 4284 wnpxv2.exe 1728 wnpxv2.exe 632 wnpxv2.exe 2304 wnpxv2.exe 2592 wnpxv2.exe 4312 wnpxv2.exe 4380 wnpxv2.exe 5048 wnpxv2.exe 3548 wnpxv2.exe 928 wnpxv2.exe 3532 wnpxv2.exe 4956 wnpxv2.exe 948 wnpxv2.exe 1020 wnpxv2.exe 4728 wnpxv2.exe 5060 wnpxv2.exe 2688 wnpxv2.exe 4648 wnpxv2.exe 1408 wnpxv2.exe 2248 wnpxv2.exe 2432 wnpxv2.exe 4796 wnpxv2.exe 4928 wnpxv2.exe 1364 wnpxv2.exe 3852 wnpxv2.exe 3796 wnpxv2.exe 1572 wnpxv2.exe 3656 wnpxv2.exe 1940 wnpxv2.exe 1216 wnpxv2.exe 1972 wnpxv2.exe 3144 wnpxv2.exe 4440 wnpxv2.exe 4376 wnpxv2.exe 5048 wnpxv2.exe 1044 wnpxv2.exe 2252 wnpxv2.exe 368 wnpxv2.exe 3504 wnpxv2.exe 4764 wnpxv2.exe 2752 wnpxv2.exe 2300 wnpxv2.exe 440 wnpxv2.exe -
Maps connected drives based on registry 3 TTPs 56 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnpxv2.exe -
Drops file in System32 directory 54 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File opened for modification C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe File created C:\Windows\SysWOW64\wnpxv2.exe wnpxv2.exe -
Suspicious use of SetThreadContext 28 IoCs
description pid Process procid_target PID 4208 set thread context of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 1924 set thread context of 2964 1924 wnpxv2.exe 84 PID 3068 set thread context of 936 3068 wnpxv2.exe 90 PID 5112 set thread context of 740 5112 wnpxv2.exe 95 PID 1224 set thread context of 2272 1224 wnpxv2.exe 97 PID 1860 set thread context of 4000 1860 wnpxv2.exe 99 PID 768 set thread context of 4284 768 wnpxv2.exe 102 PID 1728 set thread context of 632 1728 wnpxv2.exe 105 PID 2304 set thread context of 2592 2304 wnpxv2.exe 107 PID 4312 set thread context of 4380 4312 wnpxv2.exe 109 PID 5048 set thread context of 3548 5048 wnpxv2.exe 111 PID 928 set thread context of 3532 928 wnpxv2.exe 113 PID 4956 set thread context of 948 4956 wnpxv2.exe 115 PID 1020 set thread context of 4728 1020 wnpxv2.exe 117 PID 5060 set thread context of 2688 5060 wnpxv2.exe 119 PID 4648 set thread context of 1408 4648 wnpxv2.exe 121 PID 2248 set thread context of 2432 2248 wnpxv2.exe 123 PID 4796 set thread context of 4928 4796 wnpxv2.exe 125 PID 1364 set thread context of 3852 1364 wnpxv2.exe 127 PID 3796 set thread context of 1572 3796 wnpxv2.exe 129 PID 3656 set thread context of 1940 3656 wnpxv2.exe 131 PID 1216 set thread context of 1972 1216 wnpxv2.exe 133 PID 3144 set thread context of 4440 3144 wnpxv2.exe 135 PID 4376 set thread context of 5048 4376 wnpxv2.exe 137 PID 1044 set thread context of 2252 1044 wnpxv2.exe 139 PID 368 set thread context of 3504 368 wnpxv2.exe 141 PID 4764 set thread context of 2752 4764 wnpxv2.exe 143 PID 2300 set thread context of 440 2300 wnpxv2.exe 145 -
resource yara_rule behavioral2/memory/4224-0-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4224-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4224-3-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4224-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4224-38-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2964-43-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2964-45-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2964-44-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2964-47-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/936-51-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/936-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/936-53-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/740-61-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2272-68-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4000-75-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4284-82-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4284-84-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/632-92-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2592-99-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4380-106-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3548-114-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3532-120-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/948-126-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/948-131-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4728-139-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2688-148-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1408-156-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2432-164-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4928-173-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3852-181-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1572-189-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1940-197-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1972-205-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4440-213-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/5048-220-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2252-226-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3504-232-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2752-238-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 55 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpxv2.exe -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpxv2.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4224 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 4224 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 2964 wnpxv2.exe 2964 wnpxv2.exe 936 wnpxv2.exe 936 wnpxv2.exe 740 wnpxv2.exe 740 wnpxv2.exe 2272 wnpxv2.exe 2272 wnpxv2.exe 4000 wnpxv2.exe 4000 wnpxv2.exe 4284 wnpxv2.exe 4284 wnpxv2.exe 632 wnpxv2.exe 632 wnpxv2.exe 2592 wnpxv2.exe 2592 wnpxv2.exe 4380 wnpxv2.exe 4380 wnpxv2.exe 3548 wnpxv2.exe 3548 wnpxv2.exe 3532 wnpxv2.exe 3532 wnpxv2.exe 948 wnpxv2.exe 948 wnpxv2.exe 4728 wnpxv2.exe 4728 wnpxv2.exe 2688 wnpxv2.exe 2688 wnpxv2.exe 1408 wnpxv2.exe 1408 wnpxv2.exe 2432 wnpxv2.exe 2432 wnpxv2.exe 4928 wnpxv2.exe 4928 wnpxv2.exe 3852 wnpxv2.exe 3852 wnpxv2.exe 1572 wnpxv2.exe 1572 wnpxv2.exe 1940 wnpxv2.exe 1940 wnpxv2.exe 1972 wnpxv2.exe 1972 wnpxv2.exe 4440 wnpxv2.exe 4440 wnpxv2.exe 5048 wnpxv2.exe 5048 wnpxv2.exe 2252 wnpxv2.exe 2252 wnpxv2.exe 3504 wnpxv2.exe 3504 wnpxv2.exe 2752 wnpxv2.exe 2752 wnpxv2.exe 440 wnpxv2.exe 440 wnpxv2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4208 wrote to memory of 4224 4208 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 82 PID 4224 wrote to memory of 1924 4224 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 83 PID 4224 wrote to memory of 1924 4224 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 83 PID 4224 wrote to memory of 1924 4224 dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe 83 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 1924 wrote to memory of 2964 1924 wnpxv2.exe 84 PID 2964 wrote to memory of 3068 2964 wnpxv2.exe 89 PID 2964 wrote to memory of 3068 2964 wnpxv2.exe 89 PID 2964 wrote to memory of 3068 2964 wnpxv2.exe 89 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 3068 wrote to memory of 936 3068 wnpxv2.exe 90 PID 936 wrote to memory of 5112 936 wnpxv2.exe 94 PID 936 wrote to memory of 5112 936 wnpxv2.exe 94 PID 936 wrote to memory of 5112 936 wnpxv2.exe 94 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 5112 wrote to memory of 740 5112 wnpxv2.exe 95 PID 740 wrote to memory of 1224 740 wnpxv2.exe 96 PID 740 wrote to memory of 1224 740 wnpxv2.exe 96 PID 740 wrote to memory of 1224 740 wnpxv2.exe 96 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 1224 wrote to memory of 2272 1224 wnpxv2.exe 97 PID 2272 wrote to memory of 1860 2272 wnpxv2.exe 98 PID 2272 wrote to memory of 1860 2272 wnpxv2.exe 98 PID 2272 wrote to memory of 1860 2272 wnpxv2.exe 98 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 1860 wrote to memory of 4000 1860 wnpxv2.exe 99 PID 4000 wrote to memory of 768 4000 wnpxv2.exe 101 PID 4000 wrote to memory of 768 4000 wnpxv2.exe 101 PID 4000 wrote to memory of 768 4000 wnpxv2.exe 101 PID 768 wrote to memory of 4284 768 wnpxv2.exe 102 PID 768 wrote to memory of 4284 768 wnpxv2.exe 102 PID 768 wrote to memory of 4284 768 wnpxv2.exe 102 PID 768 wrote to memory of 4284 768 wnpxv2.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbb207f2e80c2dfed39597a40539bd9b_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Users\Admin\AppData\Local\Temp\DBB207~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Users\Admin\AppData\Local\Temp\DBB207~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4284 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:632 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4380 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3548 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:928 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3532 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:948 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4728 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5060 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1408 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4928 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3852 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1572 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4440 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5048 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2252 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:368 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3504 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\SysWOW64\wnpxv2.exe"C:\Windows\system32\wnpxv2.exe" C:\Windows\SysWOW64\wnpxv2.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5dbb207f2e80c2dfed39597a40539bd9b
SHA11409ec7f6a72e167c2353a5800cf1d47eceef7d0
SHA256c5b4a36ebdb894e55eb1a0ce991ea8e4e72d86d0945977b892831d7d96d358e9
SHA512a50aa1af17fc47b8fef2100207c20a3ad65e689430b76b8f4646c7021306d7c86d86a24307a999b66f252a954a912addd676375d0d778393e063a5fce77ed310