metasploit | 2bb11676d3671ade6eb5192012a52e7e1cc339ee6f6c36b3fb0942758856707e

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9782af747d74702719c2da418256e164.exe
Size

235KB
MD5

9782af747d74702719c2da418256e164
SHA1

0ed275cbaeb7ad327172547dc036abdfdca163f5
SHA256

2bb11676d3671ade6eb5192012a52e7e1cc339ee6f6c36b3fb0942758856707e
SHA512

94bd7410ee4f8314a0ce84617a0c87f9b197e54ebd99227cafb8572850cd7abaf12e400c5d368c7277a2e220dfd04078fe448d53410a82bc3429c207a04f8a78
SSDEEP

6144:mutjlpnPEdCtNULSvL68fdda7JWcApjHDn:muVznsSfjXDtDXn

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2788	wmiptsn.exe

Executes dropped EXE 64 IoCs

pid	Process
2500	wmiptsn.exe
2788	wmiptsn.exe
2708	wmiptsn.exe
2848	wmiptsn.exe
2608	wmiptsn.exe
2760	wmiptsn.exe
1008	wmiptsn.exe
1872	wmiptsn.exe
756	wmiptsn.exe
1656	wmiptsn.exe
1888	wmiptsn.exe
2860	wmiptsn.exe
1568	wmiptsn.exe
2952	wmiptsn.exe
2440	wmiptsn.exe
2212	wmiptsn.exe
920	wmiptsn.exe
1652	wmiptsn.exe
824	wmiptsn.exe
1836	wmiptsn.exe
3052	wmiptsn.exe
272	wmiptsn.exe
1492	wmiptsn.exe
1512	wmiptsn.exe
3000	wmiptsn.exe
1876	wmiptsn.exe
2816	wmiptsn.exe
2744	wmiptsn.exe
2752	wmiptsn.exe
2728	wmiptsn.exe
1340	wmiptsn.exe
2088	wmiptsn.exe
1196	wmiptsn.exe
2888	wmiptsn.exe
2644	wmiptsn.exe
1992	wmiptsn.exe
1908	wmiptsn.exe
2964	wmiptsn.exe
2360	wmiptsn.exe
2776	wmiptsn.exe
2044	wmiptsn.exe
2196	wmiptsn.exe
816	wmiptsn.exe
1404	wmiptsn.exe
2208	wmiptsn.exe
1640	wmiptsn.exe
1616	wmiptsn.exe
1592	wmiptsn.exe
2564	wmiptsn.exe
2192	wmiptsn.exe
2124	wmiptsn.exe
1708	wmiptsn.exe
1556	wmiptsn.exe
2504	wmiptsn.exe
2260	wmiptsn.exe
2276	wmiptsn.exe
2816	wmiptsn.exe
2796	wmiptsn.exe
2636	wmiptsn.exe
2588	wmiptsn.exe
2184	wmiptsn.exe
856	wmiptsn.exe
2496	wmiptsn.exe
2580	wmiptsn.exe

Loads dropped DLL 64 IoCs

pid	Process
2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe
2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe
2788	wmiptsn.exe
2788	wmiptsn.exe
2848	wmiptsn.exe
2848	wmiptsn.exe
2760	wmiptsn.exe
2760	wmiptsn.exe
1872	wmiptsn.exe
1872	wmiptsn.exe
1656	wmiptsn.exe
1656	wmiptsn.exe
2860	wmiptsn.exe
2860	wmiptsn.exe
2952	wmiptsn.exe
2952	wmiptsn.exe
2212	wmiptsn.exe
2212	wmiptsn.exe
1652	wmiptsn.exe
1652	wmiptsn.exe
1836	wmiptsn.exe
1836	wmiptsn.exe
272	wmiptsn.exe
272	wmiptsn.exe
1512	wmiptsn.exe
1512	wmiptsn.exe
1876	wmiptsn.exe
1876	wmiptsn.exe
2744	wmiptsn.exe
2744	wmiptsn.exe
2728	wmiptsn.exe
2728	wmiptsn.exe
2088	wmiptsn.exe
2088	wmiptsn.exe
2888	wmiptsn.exe
2888	wmiptsn.exe
1992	wmiptsn.exe
1992	wmiptsn.exe
2964	wmiptsn.exe
2964	wmiptsn.exe
2776	wmiptsn.exe
2776	wmiptsn.exe
2196	wmiptsn.exe
2196	wmiptsn.exe
1404	wmiptsn.exe
1404	wmiptsn.exe
1640	wmiptsn.exe
1640	wmiptsn.exe
1592	wmiptsn.exe
1592	wmiptsn.exe
2192	wmiptsn.exe
2192	wmiptsn.exe
1708	wmiptsn.exe
1708	wmiptsn.exe
2504	wmiptsn.exe
2504	wmiptsn.exe
2276	wmiptsn.exe
2276	wmiptsn.exe
2796	wmiptsn.exe
2796	wmiptsn.exe
2588	wmiptsn.exe
2588	wmiptsn.exe
856	wmiptsn.exe
856	wmiptsn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	JaffaCakes118_9782af747d74702719c2da418256e164.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	JaffaCakes118_9782af747d74702719c2da418256e164.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File opened for modification	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe
File created	C:\Windows\SysWOW64\wmiptsn.exe	wmiptsn.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 2500 set thread context of 2788	2500	wmiptsn.exe	32
PID 2708 set thread context of 2848	2708	wmiptsn.exe	34
PID 2608 set thread context of 2760	2608	wmiptsn.exe	36
PID 1008 set thread context of 1872	1008	wmiptsn.exe	39
PID 756 set thread context of 1656	756	wmiptsn.exe	41
PID 1888 set thread context of 2860	1888	wmiptsn.exe	43
PID 1568 set thread context of 2952	1568	wmiptsn.exe	45
PID 2440 set thread context of 2212	2440	wmiptsn.exe	47
PID 920 set thread context of 1652	920	wmiptsn.exe	49
PID 824 set thread context of 1836	824	wmiptsn.exe	51
PID 3052 set thread context of 272	3052	wmiptsn.exe	53
PID 1492 set thread context of 1512	1492	wmiptsn.exe	55
PID 3000 set thread context of 1876	3000	wmiptsn.exe	57
PID 2816 set thread context of 2744	2816	wmiptsn.exe	59
PID 2752 set thread context of 2728	2752	wmiptsn.exe	61
PID 1340 set thread context of 2088	1340	wmiptsn.exe	63
PID 1196 set thread context of 2888	1196	wmiptsn.exe	65
PID 2644 set thread context of 1992	2644	wmiptsn.exe	67
PID 1908 set thread context of 2964	1908	wmiptsn.exe	69
PID 2360 set thread context of 2776	2360	wmiptsn.exe	71
PID 2044 set thread context of 2196	2044	wmiptsn.exe	73
PID 816 set thread context of 1404	816	wmiptsn.exe	75
PID 2208 set thread context of 1640	2208	wmiptsn.exe	77
PID 1616 set thread context of 1592	1616	wmiptsn.exe	79
PID 2564 set thread context of 2192	2564	wmiptsn.exe	81
PID 2124 set thread context of 1708	2124	wmiptsn.exe	83
PID 1556 set thread context of 2504	1556	wmiptsn.exe	85
PID 2260 set thread context of 2276	2260	wmiptsn.exe	87
PID 2816 set thread context of 2796	2816	wmiptsn.exe	89
PID 2636 set thread context of 2588	2636	wmiptsn.exe	91
PID 2184 set thread context of 856	2184	wmiptsn.exe	93
PID 2496 set thread context of 2580	2496	wmiptsn.exe	95
PID 1728 set thread context of 1852	1728	wmiptsn.exe	97
PID 2988 set thread context of 2992	2988	wmiptsn.exe	99
PID 2948 set thread context of 2692	2948	wmiptsn.exe	101
PID 2180 set thread context of 1720	2180	wmiptsn.exe	103
PID 2568 set thread context of 532	2568	wmiptsn.exe	105
PID 1844 set thread context of 1208	1844	wmiptsn.exe	107
PID 1396 set thread context of 2564	1396	wmiptsn.exe	109
PID 2416 set thread context of 3020	2416	wmiptsn.exe	111
PID 1900 set thread context of 2672	1900	wmiptsn.exe	113
PID 2300 set thread context of 1832	2300	wmiptsn.exe	115
PID 2816 set thread context of 2916	2816	wmiptsn.exe	117
PID 2652 set thread context of 2876	2652	wmiptsn.exe	119
PID 2612 set thread context of 2640	2612	wmiptsn.exe	121
PID 2072 set thread context of 868	2072	wmiptsn.exe	123
PID 1008 set thread context of 1968	1008	wmiptsn.exe	125
PID 1728 set thread context of 2832	1728	wmiptsn.exe	127
PID 2988 set thread context of 1548	2988	wmiptsn.exe	129
PID 1124 set thread context of 408	1124	wmiptsn.exe	131
PID 1416 set thread context of 1928	1416	wmiptsn.exe	133
PID 1952 set thread context of 984	1952	wmiptsn.exe	135
PID 2164 set thread context of 2936	2164	wmiptsn.exe	137
PID 880 set thread context of 3060	880	wmiptsn.exe	139
PID 1880 set thread context of 2280	1880	wmiptsn.exe	141
PID 2804 set thread context of 2720	2804	wmiptsn.exe	143
PID 2220 set thread context of 2960	2220	wmiptsn.exe	145
PID 2840 set thread context of 2620	2840	wmiptsn.exe	147
PID 1760 set thread context of 2648	1760	wmiptsn.exe	149
PID 2432 set thread context of 1388	2432	wmiptsn.exe	151
PID 2660 set thread context of 2864	2660	wmiptsn.exe	153
PID 1180 set thread context of 1888	1180	wmiptsn.exe	155
PID 2984 set thread context of 2928	2984	wmiptsn.exe	157

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2556-6-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-9-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-7-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-4-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-3-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-2-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-8-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2556-22-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2788-33-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2788-36-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2788-35-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2788-34-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2788-42-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2848-53-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2848-59-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2760-70-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2760-76-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1872-85-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1872-86-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1872-93-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1656-109-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2860-125-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2952-143-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2212-159-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1652-175-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1836-184-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1836-193-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/272-209-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1512-226-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1876-242-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2744-254-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2728-266-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2088-274-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2088-279-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2888-291-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1992-303-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2964-311-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2964-316-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2776-328-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2196-340-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1404-352-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1640-364-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1592-376-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2192-388-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1708-400-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2504-412-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2276-424-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2796-436-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2588-448-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/856-460-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2580-472-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1852-484-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2992-496-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2692-508-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1720-520-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/532-529-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/532-533-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1208-545-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2564-557-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/3020-569-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2672-581-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1832-593-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2916-602-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/2916-606-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9782af747d74702719c2da418256e164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmiptsn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe
2788	wmiptsn.exe
2848	wmiptsn.exe
2760	wmiptsn.exe
1872	wmiptsn.exe
1656	wmiptsn.exe
2860	wmiptsn.exe
2952	wmiptsn.exe
2212	wmiptsn.exe
1652	wmiptsn.exe
1836	wmiptsn.exe
272	wmiptsn.exe
1512	wmiptsn.exe
1876	wmiptsn.exe
2744	wmiptsn.exe
2728	wmiptsn.exe
2088	wmiptsn.exe
2888	wmiptsn.exe
1992	wmiptsn.exe
2964	wmiptsn.exe
2776	wmiptsn.exe
2196	wmiptsn.exe
1404	wmiptsn.exe
1640	wmiptsn.exe
1592	wmiptsn.exe
2192	wmiptsn.exe
1708	wmiptsn.exe
2504	wmiptsn.exe
2276	wmiptsn.exe
2796	wmiptsn.exe
2588	wmiptsn.exe
856	wmiptsn.exe
2580	wmiptsn.exe
1852	wmiptsn.exe
2992	wmiptsn.exe
2692	wmiptsn.exe
1720	wmiptsn.exe
532	wmiptsn.exe
1208	wmiptsn.exe
2564	wmiptsn.exe
3020	wmiptsn.exe
2672	wmiptsn.exe
1832	wmiptsn.exe
2916	wmiptsn.exe
2876	wmiptsn.exe
2640	wmiptsn.exe
868	wmiptsn.exe
1968	wmiptsn.exe
2832	wmiptsn.exe
1548	wmiptsn.exe
408	wmiptsn.exe
1928	wmiptsn.exe
984	wmiptsn.exe
2936	wmiptsn.exe
3060	wmiptsn.exe
2280	wmiptsn.exe
2720	wmiptsn.exe
2960	wmiptsn.exe
2620	wmiptsn.exe
2648	wmiptsn.exe
1388	wmiptsn.exe
2864	wmiptsn.exe
1888	wmiptsn.exe
2928	wmiptsn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 1988 wrote to memory of 2556	1988	JaffaCakes118_9782af747d74702719c2da418256e164.exe	30
PID 2556 wrote to memory of 2500	2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe	31
PID 2556 wrote to memory of 2500	2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe	31
PID 2556 wrote to memory of 2500	2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe	31
PID 2556 wrote to memory of 2500	2556	JaffaCakes118_9782af747d74702719c2da418256e164.exe	31
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2500 wrote to memory of 2788	2500	wmiptsn.exe	32
PID 2788 wrote to memory of 2708	2788	wmiptsn.exe	33
PID 2788 wrote to memory of 2708	2788	wmiptsn.exe	33
PID 2788 wrote to memory of 2708	2788	wmiptsn.exe	33
PID 2788 wrote to memory of 2708	2788	wmiptsn.exe	33
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2708 wrote to memory of 2848	2708	wmiptsn.exe	34
PID 2848 wrote to memory of 2608	2848	wmiptsn.exe	35
PID 2848 wrote to memory of 2608	2848	wmiptsn.exe	35
PID 2848 wrote to memory of 2608	2848	wmiptsn.exe	35
PID 2848 wrote to memory of 2608	2848	wmiptsn.exe	35
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2608 wrote to memory of 2760	2608	wmiptsn.exe	36
PID 2760 wrote to memory of 1008	2760	wmiptsn.exe	38
PID 2760 wrote to memory of 1008	2760	wmiptsn.exe	38
PID 2760 wrote to memory of 1008	2760	wmiptsn.exe	38
PID 2760 wrote to memory of 1008	2760	wmiptsn.exe	38
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1008 wrote to memory of 1872	1008	wmiptsn.exe	39
PID 1872 wrote to memory of 756	1872	wmiptsn.exe	40
PID 1872 wrote to memory of 756	1872	wmiptsn.exe	40
PID 1872 wrote to memory of 756	1872	wmiptsn.exe	40
PID 1872 wrote to memory of 756	1872	wmiptsn.exe	40
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 756 wrote to memory of 1656	756	wmiptsn.exe	41
PID 1656 wrote to memory of 1888	1656	wmiptsn.exe	42
PID 1656 wrote to memory of 1888	1656	wmiptsn.exe	42

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9782af747d74702719c2da418256e164.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9782af747d74702719c2da418256e164.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9782af747d74702719c2da418256e164.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9782af747d74702719c2da418256e164.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\wmiptsn.exe
    "C:\Windows\system32\wmiptsn.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\wmiptsn.exe
      "C:\Windows\SysWOW64\wmiptsn.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2860
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2952
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2212
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1652
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:824
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1836
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3052
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:272
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1512
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3000
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1876
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2744
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2752
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2728
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1340
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2088
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1196
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2888
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2644
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1992
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2776
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:816
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1404
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        48⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1640
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2192
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1708
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1556
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        58⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2816
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        60⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:2796
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2636
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        62⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2588
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        64⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:856
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2496
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2580
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        67⤵
        Suspicious use of SetThreadContext
        
        PID:1728
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        68⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1852
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        69⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2992
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        71⤵
        Suspicious use of SetThreadContext
        
        PID:2948
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2692
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        73⤵
        Suspicious use of SetThreadContext
        
        PID:2180
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        74⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1720
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        75⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        76⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:532
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        77⤵
        Suspicious use of SetThreadContext
        
        PID:1844
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1208
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        79⤵
        Suspicious use of SetThreadContext
        
        PID:1396
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        80⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2564
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        81⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3020
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        83⤵
        Suspicious use of SetThreadContext
        
        PID:1900
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        84⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2672
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        85⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        86⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1832
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        87⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        88⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        89⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        90⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2876
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        91⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        92⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2640
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        93⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2072
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:868
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        95⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        96⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1968
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        97⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        98⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        99⤵
        Suspicious use of SetThreadContext
        
        PID:2988
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1548
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        101⤵
        Suspicious use of SetThreadContext
        
        PID:1124
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:408
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        103⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        104⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1928
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        105⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        106⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:984
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        107⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        108⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2936
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        109⤵
        Suspicious use of SetThreadContext
        
        PID:880
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3060
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        111⤵
        Suspicious use of SetThreadContext
        
        PID:1880
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        112⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2280
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        113⤵
        Suspicious use of SetThreadContext
        
        PID:2804
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        114⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2720
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        115⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2960
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        117⤵
        Suspicious use of SetThreadContext
        
        PID:2840
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2620
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        119⤵
        Suspicious use of SetThreadContext
        
        PID:1760
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        120⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2648
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        121⤵
        Suspicious use of SetThreadContext
        
        PID:2432
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        122⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1388
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        123⤵
        Suspicious use of SetThreadContext
        
        PID:2660
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2864
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        125⤵
        Suspicious use of SetThreadContext
        
        PID:1180
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        126⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1888
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        127⤵
        Suspicious use of SetThreadContext
        
        PID:2984
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        128⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2928
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        129⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        130⤵
        Drops file in System32 directory
        
        PID:2204
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        132⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        135⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        136⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\system32\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Windows\SysWOW64\wmiptsn.exe
        
        "C:\Windows\SysWOW64\wmiptsn.exe" C:\Windows\SysWOW64\wmiptsn.exe
        138⤵
        
        PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wmiptsn.exe

Filesize
235KB

MD5
9782af747d74702719c2da418256e164

SHA1
0ed275cbaeb7ad327172547dc036abdfdca163f5

SHA256
2bb11676d3671ade6eb5192012a52e7e1cc339ee6f6c36b3fb0942758856707e

SHA512
94bd7410ee4f8314a0ce84617a0c87f9b197e54ebd99227cafb8572850cd7abaf12e400c5d368c7277a2e220dfd04078fe448d53410a82bc3429c207a04f8a78

Download Submit
memory/272-209-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/408-690-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/532-529-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/532-533-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/856-460-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/868-642-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/984-714-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1208-545-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1388-811-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1404-352-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1448-883-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1512-226-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1548-678-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1592-376-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1640-364-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1652-175-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1656-109-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1708-400-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1720-520-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1832-593-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1836-193-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1836-184-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1852-484-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1872-93-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1872-86-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1872-85-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1876-242-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1888-835-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1928-702-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1940-871-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1968-654-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1992-303-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2088-274-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2088-279-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2192-388-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2196-340-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2204-859-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2212-159-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2276-424-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2280-750-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2504-412-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-22-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-8-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-3-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-9-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-4-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-2-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-6-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2556-7-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2564-557-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2580-472-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2588-448-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2620-787-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2640-630-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2648-799-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2672-581-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2692-508-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2720-759-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2720-763-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2728-266-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2744-254-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2760-76-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2760-70-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2776-328-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2788-34-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2788-33-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2788-36-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2788-42-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2788-35-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2796-436-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2832-666-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2848-53-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2848-59-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2860-125-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2864-823-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2876-618-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2888-291-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2916-602-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2916-606-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2928-847-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2936-726-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2952-143-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2960-775-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2964-311-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2964-316-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2992-496-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3020-569-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3052-895-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3060-738-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download