Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe
-
Size
206KB
-
MD5
fd87dbb5ac4f2e34d6d92ee71aa8297c
-
SHA1
fcbb9f727565aa481a625cdd5009feedda4421e2
-
SHA256
daceb92e6eb1e44bc3be036b3857295dafe54126a49b6a65fdbd27b307cd924c
-
SHA512
d7e6f387622ab626cdadcb220b55f6ff165252526a5676f228a53db90d1972f1a606fb282066dff3a1a0f406a6e07b0d148237fb96f69700f19c69e1ccc202ba
-
SSDEEP
6144:gmo++9aEXsjjBW6nlUgH6Az8mZBRjggJ6b:Uj9aEcjj9J1Tv5J6b
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 25 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation MsDlClient.exe -
Deletes itself 1 IoCs
pid Process 3420 MsDlClient.exe -
Executes dropped EXE 50 IoCs
pid Process 1848 MsDlClient.exe 3420 MsDlClient.exe 2008 MsDlClient.exe 552 MsDlClient.exe 2868 MsDlClient.exe 4204 MsDlClient.exe 4280 MsDlClient.exe 4124 MsDlClient.exe 4972 MsDlClient.exe 948 MsDlClient.exe 3192 MsDlClient.exe 3320 MsDlClient.exe 2288 MsDlClient.exe 4324 MsDlClient.exe 4648 MsDlClient.exe 4052 MsDlClient.exe 1488 MsDlClient.exe 3096 MsDlClient.exe 4268 MsDlClient.exe 1044 MsDlClient.exe 1616 MsDlClient.exe 2936 MsDlClient.exe 3180 MsDlClient.exe 4112 MsDlClient.exe 1552 MsDlClient.exe 1196 MsDlClient.exe 4104 MsDlClient.exe 4988 MsDlClient.exe 3928 MsDlClient.exe 3092 MsDlClient.exe 2796 MsDlClient.exe 696 MsDlClient.exe 1052 MsDlClient.exe 3860 MsDlClient.exe 1972 MsDlClient.exe 3192 MsDlClient.exe 1500 MsDlClient.exe 1636 MsDlClient.exe 4960 MsDlClient.exe 4828 MsDlClient.exe 3164 MsDlClient.exe 900 MsDlClient.exe 4744 MsDlClient.exe 1796 MsDlClient.exe 3916 MsDlClient.exe 2280 MsDlClient.exe 5104 MsDlClient.exe 3880 MsDlClient.exe 2024 MsDlClient.exe 1304 MsDlClient.exe -
Maps connected drives based on registry 3 TTPs 52 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum MsDlClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 MsDlClient.exe -
Drops file in System32 directory 50 IoCs
description ioc Process File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe File created C:\Windows\SysWOW64\MsDlClient.exe fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File created C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe File opened for modification C:\Windows\SysWOW64\MsDlClient.exe MsDlClient.exe -
Suspicious use of SetThreadContext 26 IoCs
description pid Process procid_target PID 3940 set thread context of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 1848 set thread context of 3420 1848 MsDlClient.exe 86 PID 2008 set thread context of 552 2008 MsDlClient.exe 88 PID 2868 set thread context of 4204 2868 MsDlClient.exe 90 PID 4280 set thread context of 4124 4280 MsDlClient.exe 94 PID 4972 set thread context of 948 4972 MsDlClient.exe 102 PID 3192 set thread context of 3320 3192 MsDlClient.exe 111 PID 2288 set thread context of 4324 2288 MsDlClient.exe 113 PID 4648 set thread context of 4052 4648 MsDlClient.exe 115 PID 1488 set thread context of 3096 1488 MsDlClient.exe 117 PID 4268 set thread context of 1044 4268 MsDlClient.exe 119 PID 1616 set thread context of 2936 1616 MsDlClient.exe 122 PID 3180 set thread context of 4112 3180 MsDlClient.exe 124 PID 1552 set thread context of 1196 1552 MsDlClient.exe 126 PID 4104 set thread context of 4988 4104 MsDlClient.exe 128 PID 3928 set thread context of 3092 3928 MsDlClient.exe 130 PID 2796 set thread context of 696 2796 MsDlClient.exe 132 PID 1052 set thread context of 3860 1052 MsDlClient.exe 134 PID 1972 set thread context of 3192 1972 MsDlClient.exe 136 PID 1500 set thread context of 1636 1500 MsDlClient.exe 138 PID 4960 set thread context of 4828 4960 MsDlClient.exe 140 PID 3164 set thread context of 900 3164 MsDlClient.exe 142 PID 4744 set thread context of 1796 4744 MsDlClient.exe 144 PID 3916 set thread context of 2280 3916 MsDlClient.exe 146 PID 5104 set thread context of 3880 5104 MsDlClient.exe 148 PID 2024 set thread context of 1304 2024 MsDlClient.exe 150 -
resource yara_rule behavioral2/memory/2728-0-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2728-2-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2728-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2728-4-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2728-38-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3420-43-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3420-44-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3420-45-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3420-46-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/552-53-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4204-61-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4124-68-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/948-75-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3320-83-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4324-92-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4052-97-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3096-104-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1044-113-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2936-122-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4112-131-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1196-139-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4988-147-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3092-155-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/696-163-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3860-172-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3192-180-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1636-188-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4828-197-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/900-205-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/1796-213-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/2280-220-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3880-226-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsDlClient.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ MsDlClient.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2728 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 2728 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 3420 MsDlClient.exe 3420 MsDlClient.exe 552 MsDlClient.exe 552 MsDlClient.exe 4204 MsDlClient.exe 4204 MsDlClient.exe 4124 MsDlClient.exe 4124 MsDlClient.exe 948 MsDlClient.exe 948 MsDlClient.exe 3320 MsDlClient.exe 3320 MsDlClient.exe 4324 MsDlClient.exe 4324 MsDlClient.exe 4052 MsDlClient.exe 4052 MsDlClient.exe 3096 MsDlClient.exe 3096 MsDlClient.exe 1044 MsDlClient.exe 1044 MsDlClient.exe 2936 MsDlClient.exe 2936 MsDlClient.exe 4112 MsDlClient.exe 4112 MsDlClient.exe 1196 MsDlClient.exe 1196 MsDlClient.exe 4988 MsDlClient.exe 4988 MsDlClient.exe 3092 MsDlClient.exe 3092 MsDlClient.exe 696 MsDlClient.exe 696 MsDlClient.exe 3860 MsDlClient.exe 3860 MsDlClient.exe 3192 MsDlClient.exe 3192 MsDlClient.exe 1636 MsDlClient.exe 1636 MsDlClient.exe 4828 MsDlClient.exe 4828 MsDlClient.exe 900 MsDlClient.exe 900 MsDlClient.exe 1796 MsDlClient.exe 1796 MsDlClient.exe 2280 MsDlClient.exe 2280 MsDlClient.exe 3880 MsDlClient.exe 3880 MsDlClient.exe 1304 MsDlClient.exe 1304 MsDlClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 3940 wrote to memory of 2728 3940 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 83 PID 2728 wrote to memory of 1848 2728 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 85 PID 2728 wrote to memory of 1848 2728 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 85 PID 2728 wrote to memory of 1848 2728 fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe 85 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 1848 wrote to memory of 3420 1848 MsDlClient.exe 86 PID 3420 wrote to memory of 2008 3420 MsDlClient.exe 87 PID 3420 wrote to memory of 2008 3420 MsDlClient.exe 87 PID 3420 wrote to memory of 2008 3420 MsDlClient.exe 87 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 2008 wrote to memory of 552 2008 MsDlClient.exe 88 PID 552 wrote to memory of 2868 552 MsDlClient.exe 89 PID 552 wrote to memory of 2868 552 MsDlClient.exe 89 PID 552 wrote to memory of 2868 552 MsDlClient.exe 89 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 2868 wrote to memory of 4204 2868 MsDlClient.exe 90 PID 4204 wrote to memory of 4280 4204 MsDlClient.exe 91 PID 4204 wrote to memory of 4280 4204 MsDlClient.exe 91 PID 4204 wrote to memory of 4280 4204 MsDlClient.exe 91 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4280 wrote to memory of 4124 4280 MsDlClient.exe 94 PID 4124 wrote to memory of 4972 4124 MsDlClient.exe 101 PID 4124 wrote to memory of 4972 4124 MsDlClient.exe 101 PID 4124 wrote to memory of 4972 4124 MsDlClient.exe 101 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 4972 wrote to memory of 948 4972 MsDlClient.exe 102 PID 948 wrote to memory of 3192 948 MsDlClient.exe 110 PID 948 wrote to memory of 3192 948 MsDlClient.exe 110 PID 948 wrote to memory of 3192 948 MsDlClient.exe 110 PID 3192 wrote to memory of 3320 3192 MsDlClient.exe 111 PID 3192 wrote to memory of 3320 3192 MsDlClient.exe 111 PID 3192 wrote to memory of 3320 3192 MsDlClient.exe 111 PID 3192 wrote to memory of 3320 3192 MsDlClient.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd87dbb5ac4f2e34d6d92ee71aa8297c_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Users\Admin\AppData\Local\Temp\FD87DB~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Users\Admin\AppData\Local\Temp\FD87DB~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3320 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4052 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3096 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1044 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4112 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1196 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4988 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3092 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:696 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3860 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3192 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1636 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4828 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:900 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3880 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\system32\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\MsDlClient.exe"C:\Windows\SysWOW64\MsDlClient.exe" C:\Windows\SysWOW64\MSDLCL~1.EXE52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5fd87dbb5ac4f2e34d6d92ee71aa8297c
SHA1fcbb9f727565aa481a625cdd5009feedda4421e2
SHA256daceb92e6eb1e44bc3be036b3857295dafe54126a49b6a65fdbd27b307cd924c
SHA512d7e6f387622ab626cdadcb220b55f6ff165252526a5676f228a53db90d1972f1a606fb282066dff3a1a0f406a6e07b0d148237fb96f69700f19c69e1ccc202ba