Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe
-
Size
212KB
-
MD5
e3dafa71364239a94875c5fe45894755
-
SHA1
ea12c428ba6c95a12dc40748a05f594f574302a7
-
SHA256
e3b85326a9d69f0c015b880013befcef42b5a45b2d499a63adde66cb302228ea
-
SHA512
3acb0eb662eb6f209b878eebe740f1998e61308fe54dcb745acf8e4b6d56a5563401644f3673b7b0c1315cc9e2589b98182b472f540a88316bdbdcfd4b33fd11
-
SSDEEP
6144:CCsOq7p+EBANI+lXkLV290OLmm/zHUnpa:CNx++SI1LV1O6m/zUn8
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2600 wmpxvd.exe -
Executes dropped EXE 37 IoCs
pid Process 2840 wmpxvd.exe 2600 wmpxvd.exe 2020 wmpxvd.exe 2256 wmpxvd.exe 1312 wmpxvd.exe 2664 wmpxvd.exe 1916 wmpxvd.exe 2012 wmpxvd.exe 1048 wmpxvd.exe 2248 wmpxvd.exe 2228 wmpxvd.exe 676 wmpxvd.exe 1840 wmpxvd.exe 1968 wmpxvd.exe 1044 wmpxvd.exe 768 wmpxvd.exe 1588 wmpxvd.exe 2160 wmpxvd.exe 2608 wmpxvd.exe 2720 wmpxvd.exe 1620 wmpxvd.exe 2288 wmpxvd.exe 2896 wmpxvd.exe 1912 wmpxvd.exe 348 wmpxvd.exe 536 wmpxvd.exe 2460 wmpxvd.exe 2236 wmpxvd.exe 1604 wmpxvd.exe 408 wmpxvd.exe 1764 wmpxvd.exe 1624 wmpxvd.exe 1532 wmpxvd.exe 1052 wmpxvd.exe 2200 wmpxvd.exe 1028 wmpxvd.exe 2088 wmpxvd.exe -
Loads dropped DLL 38 IoCs
pid Process 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 2600 wmpxvd.exe 2600 wmpxvd.exe 2256 wmpxvd.exe 2256 wmpxvd.exe 2664 wmpxvd.exe 2664 wmpxvd.exe 2012 wmpxvd.exe 2012 wmpxvd.exe 2248 wmpxvd.exe 2248 wmpxvd.exe 676 wmpxvd.exe 676 wmpxvd.exe 1968 wmpxvd.exe 1968 wmpxvd.exe 768 wmpxvd.exe 768 wmpxvd.exe 2160 wmpxvd.exe 2160 wmpxvd.exe 2720 wmpxvd.exe 2720 wmpxvd.exe 2288 wmpxvd.exe 2288 wmpxvd.exe 1912 wmpxvd.exe 1912 wmpxvd.exe 536 wmpxvd.exe 536 wmpxvd.exe 2236 wmpxvd.exe 2236 wmpxvd.exe 408 wmpxvd.exe 408 wmpxvd.exe 1624 wmpxvd.exe 1624 wmpxvd.exe 1052 wmpxvd.exe 1052 wmpxvd.exe 1028 wmpxvd.exe 1028 wmpxvd.exe -
Drops file in System32 directory 38 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpxvd.exe e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File created C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe File opened for modification C:\Windows\SysWOW64\wmpxvd.exe wmpxvd.exe -
Suspicious use of SetThreadContext 19 IoCs
description pid Process procid_target PID 2088 set thread context of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2840 set thread context of 2600 2840 wmpxvd.exe 32 PID 2020 set thread context of 2256 2020 wmpxvd.exe 34 PID 1312 set thread context of 2664 1312 wmpxvd.exe 37 PID 1916 set thread context of 2012 1916 wmpxvd.exe 39 PID 1048 set thread context of 2248 1048 wmpxvd.exe 41 PID 2228 set thread context of 676 2228 wmpxvd.exe 43 PID 1840 set thread context of 1968 1840 wmpxvd.exe 45 PID 1044 set thread context of 768 1044 wmpxvd.exe 47 PID 1588 set thread context of 2160 1588 wmpxvd.exe 49 PID 2608 set thread context of 2720 2608 wmpxvd.exe 51 PID 1620 set thread context of 2288 1620 wmpxvd.exe 53 PID 2896 set thread context of 1912 2896 wmpxvd.exe 55 PID 348 set thread context of 536 348 wmpxvd.exe 57 PID 2460 set thread context of 2236 2460 wmpxvd.exe 59 PID 1604 set thread context of 408 1604 wmpxvd.exe 61 PID 1764 set thread context of 1624 1764 wmpxvd.exe 63 PID 1532 set thread context of 1052 1532 wmpxvd.exe 65 PID 2200 set thread context of 1028 2200 wmpxvd.exe 67 -
resource yara_rule behavioral1/memory/2696-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-4-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-17-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-16-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-15-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-7-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-12-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2696-30-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2600-40-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2600-44-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2600-43-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2600-42-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2600-50-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2256-63-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2256-62-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2256-61-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2256-59-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2256-70-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2664-82-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2664-81-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2664-79-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2664-86-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2012-105-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2248-124-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/676-142-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1968-161-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/768-179-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2160-197-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2720-216-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2288-234-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1912-253-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/536-270-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2236-285-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/408-299-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1624-313-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1052-327-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1028-341-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpxvd.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 2600 wmpxvd.exe 2256 wmpxvd.exe 2664 wmpxvd.exe 2012 wmpxvd.exe 2248 wmpxvd.exe 676 wmpxvd.exe 1968 wmpxvd.exe 768 wmpxvd.exe 2160 wmpxvd.exe 2720 wmpxvd.exe 2288 wmpxvd.exe 1912 wmpxvd.exe 536 wmpxvd.exe 2236 wmpxvd.exe 408 wmpxvd.exe 1624 wmpxvd.exe 1052 wmpxvd.exe 1028 wmpxvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2088 wrote to memory of 2696 2088 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 30 PID 2696 wrote to memory of 2840 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2840 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2840 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 31 PID 2696 wrote to memory of 2840 2696 e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe 31 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2840 wrote to memory of 2600 2840 wmpxvd.exe 32 PID 2600 wrote to memory of 2020 2600 wmpxvd.exe 33 PID 2600 wrote to memory of 2020 2600 wmpxvd.exe 33 PID 2600 wrote to memory of 2020 2600 wmpxvd.exe 33 PID 2600 wrote to memory of 2020 2600 wmpxvd.exe 33 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2020 wrote to memory of 2256 2020 wmpxvd.exe 34 PID 2256 wrote to memory of 1312 2256 wmpxvd.exe 36 PID 2256 wrote to memory of 1312 2256 wmpxvd.exe 36 PID 2256 wrote to memory of 1312 2256 wmpxvd.exe 36 PID 2256 wrote to memory of 1312 2256 wmpxvd.exe 36 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 1312 wrote to memory of 2664 1312 wmpxvd.exe 37 PID 2664 wrote to memory of 1916 2664 wmpxvd.exe 38 PID 2664 wrote to memory of 1916 2664 wmpxvd.exe 38 PID 2664 wrote to memory of 1916 2664 wmpxvd.exe 38 PID 2664 wrote to memory of 1916 2664 wmpxvd.exe 38 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 1916 wrote to memory of 2012 1916 wmpxvd.exe 39 PID 2012 wrote to memory of 1048 2012 wmpxvd.exe 40 PID 2012 wrote to memory of 1048 2012 wmpxvd.exe 40 PID 2012 wrote to memory of 1048 2012 wmpxvd.exe 40 PID 2012 wrote to memory of 1048 2012 wmpxvd.exe 40 PID 1048 wrote to memory of 2248 1048 wmpxvd.exe 41 PID 1048 wrote to memory of 2248 1048 wmpxvd.exe 41 PID 1048 wrote to memory of 2248 1048 wmpxvd.exe 41 PID 1048 wrote to memory of 2248 1048 wmpxvd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3dafa71364239a94875c5fe45894755_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Users\Admin\AppData\Local\Temp\E3DAFA~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Users\Admin\AppData\Local\Temp\E3DAFA~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1968 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:768 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2288 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1912 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:348 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:536 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2236 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1604 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:408 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1052 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1028 -
C:\Windows\SysWOW64\wmpxvd.exe"C:\Windows\system32\wmpxvd.exe" C:\Windows\SysWOW64\wmpxvd.exe39⤵
- Executes dropped EXE
PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5e3dafa71364239a94875c5fe45894755
SHA1ea12c428ba6c95a12dc40748a05f594f574302a7
SHA256e3b85326a9d69f0c015b880013befcef42b5a45b2d499a63adde66cb302228ea
SHA5123acb0eb662eb6f209b878eebe740f1998e61308fe54dcb745acf8e4b6d56a5563401644f3673b7b0c1315cc9e2589b98182b472f540a88316bdbdcfd4b33fd11