metasploit | e3818e3a6ca3f46b323fec5a22f957eccc2c27b7fbf9e9f29b5fc6f71cb15354

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
Size

164KB
MD5

e5c9ea041891730c229c112e9e441066
SHA1

745cb8a2284ca39568db52d0b354dd16f9654e26
SHA256

e3818e3a6ca3f46b323fec5a22f957eccc2c27b7fbf9e9f29b5fc6f71cb15354
SHA512

a924e7ad283bcc39727435c0e96ea05da2d8686c3e8a8b69a8f0c950b92d5e7a3ff9d654c8f4ffa7d972611e2cd0a6d2d0adc561ee826dc7c5a03583d01e0547
SSDEEP

3072:Tm0knhie5l77PI7SlI/wobxA/LI06f/vmoxs7kqrUzgjKcUo5F:t8DfobgLI06vmoxsnUXcUa

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2884	wmptc1.exe

Executes dropped EXE 64 IoCs

pid	Process
3016	wmptc1.exe
2884	wmptc1.exe
2604	wmptc1.exe
2732	wmptc1.exe
2024	wmptc1.exe
1532	wmptc1.exe
2340	wmptc1.exe
1968	wmptc1.exe
2932	wmptc1.exe
1976	wmptc1.exe
1760	wmptc1.exe
2564	wmptc1.exe
2312	wmptc1.exe
1992	wmptc1.exe
1472	wmptc1.exe
1680	wmptc1.exe
1544	wmptc1.exe
2396	wmptc1.exe
2572	wmptc1.exe
964	wmptc1.exe
2876	wmptc1.exe
2980	wmptc1.exe
2756	wmptc1.exe
2860	wmptc1.exe
2612	wmptc1.exe
2624	wmptc1.exe
2156	wmptc1.exe
3028	wmptc1.exe
3060	wmptc1.exe
1972	wmptc1.exe
692	wmptc1.exe
1776	wmptc1.exe
396	wmptc1.exe
2300	wmptc1.exe
320	wmptc1.exe
980	wmptc1.exe
1500	wmptc1.exe
1572	wmptc1.exe
584	wmptc1.exe
1068	wmptc1.exe
1156	wmptc1.exe
2492	wmptc1.exe
3000	wmptc1.exe
1584	wmptc1.exe
2204	wmptc1.exe
2908	wmptc1.exe
2768	wmptc1.exe
2912	wmptc1.exe
1692	wmptc1.exe
844	wmptc1.exe
2184	wmptc1.exe
2064	wmptc1.exe
2528	wmptc1.exe
1468	wmptc1.exe
1580	wmptc1.exe
2460	wmptc1.exe
908	wmptc1.exe
2568	wmptc1.exe
1096	wmptc1.exe
2088	wmptc1.exe
1748	wmptc1.exe
2100	wmptc1.exe
112	wmptc1.exe
2668	wmptc1.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
2884	wmptc1.exe
2884	wmptc1.exe
2732	wmptc1.exe
2732	wmptc1.exe
1532	wmptc1.exe
1532	wmptc1.exe
1968	wmptc1.exe
1968	wmptc1.exe
1976	wmptc1.exe
1976	wmptc1.exe
2564	wmptc1.exe
2564	wmptc1.exe
1992	wmptc1.exe
1992	wmptc1.exe
1680	wmptc1.exe
1680	wmptc1.exe
2396	wmptc1.exe
2396	wmptc1.exe
964	wmptc1.exe
964	wmptc1.exe
2980	wmptc1.exe
2980	wmptc1.exe
2860	wmptc1.exe
2860	wmptc1.exe
2624	wmptc1.exe
2624	wmptc1.exe
3028	wmptc1.exe
3028	wmptc1.exe
1972	wmptc1.exe
1972	wmptc1.exe
1776	wmptc1.exe
1776	wmptc1.exe
2300	wmptc1.exe
2300	wmptc1.exe
980	wmptc1.exe
980	wmptc1.exe
1572	wmptc1.exe
1572	wmptc1.exe
1068	wmptc1.exe
1068	wmptc1.exe
2492	wmptc1.exe
2492	wmptc1.exe
1584	wmptc1.exe
1584	wmptc1.exe
2908	wmptc1.exe
2908	wmptc1.exe
2912	wmptc1.exe
2912	wmptc1.exe
844	wmptc1.exe
844	wmptc1.exe
2064	wmptc1.exe
2064	wmptc1.exe
1468	wmptc1.exe
1468	wmptc1.exe
2460	wmptc1.exe
2460	wmptc1.exe
2568	wmptc1.exe
2568	wmptc1.exe
2088	wmptc1.exe
2088	wmptc1.exe
2100	wmptc1.exe
2100	wmptc1.exe

Maps connected drives based on registry 3 TTPs 64 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	wmptc1.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\	wmptc1.exe
File opened for modification	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe
File created	C:\Windows\SysWOW64\wmptc1.exe	wmptc1.exe

Suspicious use of SetThreadContext 43 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3016 set thread context of 2884	3016	wmptc1.exe	31
PID 2604 set thread context of 2732	2604	wmptc1.exe	33
PID 2024 set thread context of 1532	2024	wmptc1.exe	35
PID 2340 set thread context of 1968	2340	wmptc1.exe	37
PID 2932 set thread context of 1976	2932	wmptc1.exe	39
PID 1760 set thread context of 2564	1760	wmptc1.exe	41
PID 2312 set thread context of 1992	2312	wmptc1.exe	43
PID 1472 set thread context of 1680	1472	wmptc1.exe	45
PID 1544 set thread context of 2396	1544	wmptc1.exe	47
PID 2572 set thread context of 964	2572	wmptc1.exe	49
PID 2876 set thread context of 2980	2876	wmptc1.exe	51
PID 2756 set thread context of 2860	2756	wmptc1.exe	53
PID 2612 set thread context of 2624	2612	wmptc1.exe	55
PID 2156 set thread context of 3028	2156	wmptc1.exe	57
PID 3060 set thread context of 1972	3060	wmptc1.exe	59
PID 692 set thread context of 1776	692	wmptc1.exe	61
PID 396 set thread context of 2300	396	wmptc1.exe	63
PID 320 set thread context of 980	320	wmptc1.exe	65
PID 1500 set thread context of 1572	1500	wmptc1.exe	67
PID 584 set thread context of 1068	584	wmptc1.exe	69
PID 1156 set thread context of 2492	1156	wmptc1.exe	71
PID 3000 set thread context of 1584	3000	wmptc1.exe	73
PID 2204 set thread context of 2908	2204	wmptc1.exe	75
PID 2768 set thread context of 2912	2768	wmptc1.exe	77
PID 1692 set thread context of 844	1692	wmptc1.exe	79
PID 2184 set thread context of 2064	2184	wmptc1.exe	81
PID 2528 set thread context of 1468	2528	wmptc1.exe	83
PID 1580 set thread context of 2460	1580	wmptc1.exe	85
PID 908 set thread context of 2568	908	wmptc1.exe	87
PID 1096 set thread context of 2088	1096	wmptc1.exe	89
PID 1748 set thread context of 2100	1748	wmptc1.exe	91
PID 112 set thread context of 2668	112	wmptc1.exe	93
PID 2440 set thread context of 1804	2440	wmptc1.exe	95
PID 1524 set thread context of 1604	1524	wmptc1.exe	97
PID 2988 set thread context of 2204	2988	wmptc1.exe	99
PID 2796 set thread context of 2768	2796	wmptc1.exe	101
PID 2560 set thread context of 2136	2560	wmptc1.exe	103
PID 2992 set thread context of 3032	2992	wmptc1.exe	105
PID 2504 set thread context of 2808	2504	wmptc1.exe	107
PID 1176 set thread context of 2308	1176	wmptc1.exe	109
PID 2348 set thread context of 2432	2348	wmptc1.exe	111
PID 2000 set thread context of 1096	2000	wmptc1.exe	113

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-10-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-14-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-15-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-13-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-12-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-6-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-4-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2240-28-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2884-39-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2884-40-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2884-42-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2884-41-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2884-48-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2732-61-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2732-60-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2732-59-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2732-69-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1532-77-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1532-86-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1968-99-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1968-105-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1976-116-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1976-126-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2564-135-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2564-142-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1992-156-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1992-165-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1680-174-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1680-182-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2396-193-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2396-202-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/964-213-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/964-221-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2980-232-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2980-242-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2860-251-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2860-260-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2624-280-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/3028-288-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/3028-295-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1972-307-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1776-317-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1776-322-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2300-332-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2300-338-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/980-347-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/980-352-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1572-362-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1572-369-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1068-377-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1068-382-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2492-392-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2492-397-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1584-407-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1584-412-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2908-422-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2908-427-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2912-437-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2912-442-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/844-452-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/844-459-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2064-467-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/2064-472-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/1468-481-0x0000000000400000-0x000000000045B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmptc1.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
2884	wmptc1.exe
2732	wmptc1.exe
1532	wmptc1.exe
1968	wmptc1.exe
1976	wmptc1.exe
2564	wmptc1.exe
1992	wmptc1.exe
1680	wmptc1.exe
2396	wmptc1.exe
964	wmptc1.exe
2980	wmptc1.exe
2860	wmptc1.exe
2624	wmptc1.exe
3028	wmptc1.exe
1972	wmptc1.exe
1776	wmptc1.exe
2300	wmptc1.exe
980	wmptc1.exe
1572	wmptc1.exe
1068	wmptc1.exe
2492	wmptc1.exe
1584	wmptc1.exe
2908	wmptc1.exe
2912	wmptc1.exe
844	wmptc1.exe
2064	wmptc1.exe
1468	wmptc1.exe
2460	wmptc1.exe
2568	wmptc1.exe
2088	wmptc1.exe
2100	wmptc1.exe
2668	wmptc1.exe
1804	wmptc1.exe
1604	wmptc1.exe
2204	wmptc1.exe
2768	wmptc1.exe
2136	wmptc1.exe
3032	wmptc1.exe
2808	wmptc1.exe
2308	wmptc1.exe
2432	wmptc1.exe
1096	wmptc1.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
3016	wmptc1.exe
2604	wmptc1.exe
2024	wmptc1.exe
2340	wmptc1.exe
2932	wmptc1.exe
1760	wmptc1.exe
2312	wmptc1.exe
1472	wmptc1.exe
1544	wmptc1.exe
2572	wmptc1.exe
2876	wmptc1.exe
2756	wmptc1.exe
2612	wmptc1.exe
2156	wmptc1.exe
3060	wmptc1.exe
692	wmptc1.exe
396	wmptc1.exe
320	wmptc1.exe
1500	wmptc1.exe
584	wmptc1.exe
1156	wmptc1.exe
3000	wmptc1.exe
2204	wmptc1.exe
2768	wmptc1.exe
1692	wmptc1.exe
2184	wmptc1.exe
2528	wmptc1.exe
1580	wmptc1.exe
908	wmptc1.exe
1096	wmptc1.exe
1748	wmptc1.exe
112	wmptc1.exe
2440	wmptc1.exe
1524	wmptc1.exe
2988	wmptc1.exe
2796	wmptc1.exe
2560	wmptc1.exe
2992	wmptc1.exe
2504	wmptc1.exe
1176	wmptc1.exe
2348	wmptc1.exe
2000	wmptc1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 3000 wrote to memory of 2240	3000	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	29
PID 2240 wrote to memory of 3016	2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	30
PID 2240 wrote to memory of 3016	2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	30
PID 2240 wrote to memory of 3016	2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	30
PID 2240 wrote to memory of 3016	2240	e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 3016 wrote to memory of 2884	3016	wmptc1.exe	31
PID 2884 wrote to memory of 2604	2884	wmptc1.exe	32
PID 2884 wrote to memory of 2604	2884	wmptc1.exe	32
PID 2884 wrote to memory of 2604	2884	wmptc1.exe	32
PID 2884 wrote to memory of 2604	2884	wmptc1.exe	32
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2604 wrote to memory of 2732	2604	wmptc1.exe	33
PID 2732 wrote to memory of 2024	2732	wmptc1.exe	34
PID 2732 wrote to memory of 2024	2732	wmptc1.exe	34
PID 2732 wrote to memory of 2024	2732	wmptc1.exe	34
PID 2732 wrote to memory of 2024	2732	wmptc1.exe	34
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 2024 wrote to memory of 1532	2024	wmptc1.exe	35
PID 1532 wrote to memory of 2340	1532	wmptc1.exe	36
PID 1532 wrote to memory of 2340	1532	wmptc1.exe	36
PID 1532 wrote to memory of 2340	1532	wmptc1.exe	36
PID 1532 wrote to memory of 2340	1532	wmptc1.exe	36
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 2340 wrote to memory of 1968	2340	wmptc1.exe	37
PID 1968 wrote to memory of 2932	1968	wmptc1.exe	38
PID 1968 wrote to memory of 2932	1968	wmptc1.exe	38
PID 1968 wrote to memory of 2932	1968	wmptc1.exe	38
PID 1968 wrote to memory of 2932	1968	wmptc1.exe	38
PID 2932 wrote to memory of 1976	2932	wmptc1.exe	39
PID 2932 wrote to memory of 1976	2932	wmptc1.exe	39
PID 2932 wrote to memory of 1976	2932	wmptc1.exe	39
PID 2932 wrote to memory of 1976	2932	wmptc1.exe	39

C:\Users\Admin\AppData\Local\Temp\e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e5c9ea041891730c229c112e9e441066_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\wmptc1.exe
    "C:\Windows\system32\wmptc1.exe" C:\Users\Admin\AppData\Local\Temp\E5C9EA~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\SysWOW64\wmptc1.exe
      "C:\Windows\SysWOW64\wmptc1.exe" C:\Users\Admin\AppData\Local\Temp\E5C9EA~1.EXE
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2604
      - C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1976
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1760
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2564
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1992
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1680
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1544
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2396
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:964
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2980
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2624
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3028
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1972
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1776
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:980
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1572
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1068
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1156
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2492
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3000
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1584
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2204
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        48⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2768
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2912
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:844
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1468
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        58⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2460
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:908
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        60⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2568
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1096
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2088
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1748
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        64⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2100
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:112
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2668
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        67⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2440
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        68⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1804
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        69⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1524
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        70⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1604
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        71⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        72⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2204
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        73⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        74⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2768
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        75⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        76⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2136
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        77⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        78⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3032
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        79⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        80⤵
        Maps connected drives based on registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2808
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        81⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1176
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        82⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2308
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        83⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        84⤵
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\system32\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        85⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Windows\SysWOW64\wmptc1.exe
        
        "C:\Windows\SysWOW64\wmptc1.exe" C:\Windows\SysWOW64\wmptc1.exe
        86⤵
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wmptc1.exe

Filesize
164KB

MD5
e5c9ea041891730c229c112e9e441066

SHA1
745cb8a2284ca39568db52d0b354dd16f9654e26

SHA256
e3818e3a6ca3f46b323fec5a22f957eccc2c27b7fbf9e9f29b5fc6f71cb15354

SHA512
a924e7ad283bcc39727435c0e96ea05da2d8686c3e8a8b69a8f0c950b92d5e7a3ff9d654c8f4ffa7d972611e2cd0a6d2d0adc561ee826dc7c5a03583d01e0547

Download Submit
memory/844-459-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/844-452-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/964-213-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/964-221-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/980-347-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/980-352-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1068-377-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1068-382-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1096-707-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1468-481-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1468-487-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1532-77-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1532-86-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1572-362-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1572-369-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1584-412-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1584-407-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1604-586-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1604-592-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1680-182-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1680-174-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1776-317-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1776-322-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1804-572-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1804-579-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1968-99-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1968-105-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1972-307-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1976-126-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1976-116-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1992-156-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1992-165-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2064-472-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2064-467-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2088-532-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2088-527-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2100-542-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2100-547-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2136-637-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2204-606-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-28-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2240-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-15-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2300-332-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2300-338-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2308-675-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2308-680-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2396-193-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2396-202-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2432-695-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2432-690-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2460-502-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2460-497-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2492-397-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2492-392-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-142-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-135-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2568-514-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2568-517-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2624-280-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2668-556-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2668-562-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-61-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-60-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-69-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2732-59-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2768-616-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2768-621-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2808-660-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2808-665-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2860-260-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2860-251-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-48-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-41-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-42-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-39-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-40-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2908-422-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2908-427-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2912-437-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2912-442-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2980-242-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2980-232-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3028-288-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3028-295-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3032-652-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3032-645-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download