Analysis
-
max time kernel
149s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 20:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe
-
Size
138KB
-
MD5
9703af3ac23b598954c27b06eac7a4a8
-
SHA1
b67d5b23ae2d8f6a6c2a3b9814b4e99ca3d8ee7b
-
SHA256
064c7a174d2b6379992817a7cb4e17ad522606c7950a16b47bed9d018b663aca
-
SHA512
5f96438bd86452e3d50b912e0d026d13313cc8b49e52eac771cd5af237632a0dda80b8c39152fe0eaecc1baf4c0b2801bd6a111ec7b010c687e516deccd42be6
-
SSDEEP
3072:43EdaSlB4ch4vyRNQ0gAsy1FGnQ3CTR/lXjNnKPfq4JKo:us4cOKoW/ORTFlTNnKXVj
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2864 wmpdtf32.exe -
Executes dropped EXE 30 IoCs
pid Process 3012 wmpdtf32.exe 2864 wmpdtf32.exe 1656 wmpdtf32.exe 2836 wmpdtf32.exe 2604 wmpdtf32.exe 1784 wmpdtf32.exe 1520 wmpdtf32.exe 2812 wmpdtf32.exe 2340 wmpdtf32.exe 396 wmpdtf32.exe 2260 wmpdtf32.exe 1116 wmpdtf32.exe 1680 wmpdtf32.exe 2280 wmpdtf32.exe 456 wmpdtf32.exe 2064 wmpdtf32.exe 796 wmpdtf32.exe 1800 wmpdtf32.exe 1264 wmpdtf32.exe 1484 wmpdtf32.exe 892 wmpdtf32.exe 1544 wmpdtf32.exe 1652 wmpdtf32.exe 1272 wmpdtf32.exe 2580 wmpdtf32.exe 2924 wmpdtf32.exe 2860 wmpdtf32.exe 2960 wmpdtf32.exe 2796 wmpdtf32.exe 2352 wmpdtf32.exe -
Loads dropped DLL 60 IoCs
pid Process 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 3012 wmpdtf32.exe 3012 wmpdtf32.exe 2864 wmpdtf32.exe 2864 wmpdtf32.exe 1656 wmpdtf32.exe 1656 wmpdtf32.exe 2836 wmpdtf32.exe 2836 wmpdtf32.exe 2604 wmpdtf32.exe 2604 wmpdtf32.exe 1784 wmpdtf32.exe 1784 wmpdtf32.exe 1520 wmpdtf32.exe 1520 wmpdtf32.exe 2812 wmpdtf32.exe 2812 wmpdtf32.exe 2340 wmpdtf32.exe 2340 wmpdtf32.exe 396 wmpdtf32.exe 396 wmpdtf32.exe 2260 wmpdtf32.exe 2260 wmpdtf32.exe 1116 wmpdtf32.exe 1116 wmpdtf32.exe 1680 wmpdtf32.exe 1680 wmpdtf32.exe 2280 wmpdtf32.exe 2280 wmpdtf32.exe 456 wmpdtf32.exe 456 wmpdtf32.exe 2064 wmpdtf32.exe 2064 wmpdtf32.exe 796 wmpdtf32.exe 796 wmpdtf32.exe 1800 wmpdtf32.exe 1800 wmpdtf32.exe 1264 wmpdtf32.exe 1264 wmpdtf32.exe 1484 wmpdtf32.exe 1484 wmpdtf32.exe 892 wmpdtf32.exe 892 wmpdtf32.exe 1544 wmpdtf32.exe 1544 wmpdtf32.exe 1652 wmpdtf32.exe 1652 wmpdtf32.exe 1272 wmpdtf32.exe 1272 wmpdtf32.exe 2580 wmpdtf32.exe 2580 wmpdtf32.exe 2924 wmpdtf32.exe 2924 wmpdtf32.exe 2860 wmpdtf32.exe 2860 wmpdtf32.exe 2960 wmpdtf32.exe 2960 wmpdtf32.exe 2796 wmpdtf32.exe 2796 wmpdtf32.exe -
Maps connected drives based on registry 3 TTPs 32 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtf32.exe -
Drops file in System32 directory 48 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe File created C:\Windows\SysWOW64\wmpdtf32.exe JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File created C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtf32.exe File opened for modification C:\Windows\SysWOW64\wmpdtf32.exe wmpdtf32.exe -
Suspicious use of SetThreadContext 16 IoCs
description pid Process procid_target PID 2100 set thread context of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 3012 set thread context of 2864 3012 wmpdtf32.exe 32 PID 1656 set thread context of 2836 1656 wmpdtf32.exe 34 PID 2604 set thread context of 1784 2604 wmpdtf32.exe 36 PID 1520 set thread context of 2812 1520 wmpdtf32.exe 38 PID 2340 set thread context of 396 2340 wmpdtf32.exe 40 PID 2260 set thread context of 1116 2260 wmpdtf32.exe 42 PID 1680 set thread context of 2280 1680 wmpdtf32.exe 44 PID 456 set thread context of 2064 456 wmpdtf32.exe 46 PID 796 set thread context of 1800 796 wmpdtf32.exe 48 PID 1264 set thread context of 1484 1264 wmpdtf32.exe 50 PID 892 set thread context of 1544 892 wmpdtf32.exe 52 PID 1652 set thread context of 1272 1652 wmpdtf32.exe 54 PID 2580 set thread context of 2924 2580 wmpdtf32.exe 56 PID 2860 set thread context of 2960 2860 wmpdtf32.exe 58 PID 2796 set thread context of 2352 2796 wmpdtf32.exe 60 -
resource yara_rule behavioral1/memory/2556-8-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-9-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-6-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-4-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-3-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-2-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-7-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2556-22-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-33-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-36-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-35-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-34-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-38-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2864-45-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2836-58-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2836-62-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1784-74-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1784-76-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1784-75-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1784-82-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2812-94-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2812-95-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2812-93-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2812-102-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/396-115-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/396-121-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1116-134-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1116-141-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2280-154-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2280-160-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2064-172-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2064-179-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1800-192-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1800-199-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1484-209-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1484-212-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1544-221-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1544-225-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1272-235-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1272-238-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2924-248-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2924-251-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2960-261-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2960-264-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2352-272-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2352-277-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3028-287-0x0000000000400000-0x000000000045A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpdtf32.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 2864 wmpdtf32.exe 2864 wmpdtf32.exe 2836 wmpdtf32.exe 2836 wmpdtf32.exe 1784 wmpdtf32.exe 1784 wmpdtf32.exe 2812 wmpdtf32.exe 2812 wmpdtf32.exe 396 wmpdtf32.exe 396 wmpdtf32.exe 1116 wmpdtf32.exe 1116 wmpdtf32.exe 2280 wmpdtf32.exe 2280 wmpdtf32.exe 2064 wmpdtf32.exe 2064 wmpdtf32.exe 1800 wmpdtf32.exe 1800 wmpdtf32.exe 1484 wmpdtf32.exe 1484 wmpdtf32.exe 1544 wmpdtf32.exe 1544 wmpdtf32.exe 1272 wmpdtf32.exe 1272 wmpdtf32.exe 2924 wmpdtf32.exe 2924 wmpdtf32.exe 2960 wmpdtf32.exe 2960 wmpdtf32.exe 2352 wmpdtf32.exe 2352 wmpdtf32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2100 wrote to memory of 2556 2100 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 30 PID 2556 wrote to memory of 3012 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 31 PID 2556 wrote to memory of 3012 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 31 PID 2556 wrote to memory of 3012 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 31 PID 2556 wrote to memory of 3012 2556 JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe 31 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 3012 wrote to memory of 2864 3012 wmpdtf32.exe 32 PID 2864 wrote to memory of 1656 2864 wmpdtf32.exe 33 PID 2864 wrote to memory of 1656 2864 wmpdtf32.exe 33 PID 2864 wrote to memory of 1656 2864 wmpdtf32.exe 33 PID 2864 wrote to memory of 1656 2864 wmpdtf32.exe 33 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 1656 wrote to memory of 2836 1656 wmpdtf32.exe 34 PID 2836 wrote to memory of 2604 2836 wmpdtf32.exe 35 PID 2836 wrote to memory of 2604 2836 wmpdtf32.exe 35 PID 2836 wrote to memory of 2604 2836 wmpdtf32.exe 35 PID 2836 wrote to memory of 2604 2836 wmpdtf32.exe 35 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 2604 wrote to memory of 1784 2604 wmpdtf32.exe 36 PID 1784 wrote to memory of 1520 1784 wmpdtf32.exe 37 PID 1784 wrote to memory of 1520 1784 wmpdtf32.exe 37 PID 1784 wrote to memory of 1520 1784 wmpdtf32.exe 37 PID 1784 wrote to memory of 1520 1784 wmpdtf32.exe 37 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 1520 wrote to memory of 2812 1520 wmpdtf32.exe 38 PID 2812 wrote to memory of 2340 2812 wmpdtf32.exe 39 PID 2812 wrote to memory of 2340 2812 wmpdtf32.exe 39 PID 2812 wrote to memory of 2340 2812 wmpdtf32.exe 39 PID 2812 wrote to memory of 2340 2812 wmpdtf32.exe 39 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 2340 wrote to memory of 396 2340 wmpdtf32.exe 40 PID 396 wrote to memory of 2260 396 wmpdtf32.exe 41 PID 396 wrote to memory of 2260 396 wmpdtf32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9703af3ac23b598954c27b06eac7a4a8.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1116 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2280 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:456 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2064 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:796 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1800 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1484 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:892 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1544 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1272 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2352 -
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe33⤵PID:2080
-
C:\Windows\SysWOW64\wmpdtf32.exe"C:\Windows\system32\wmpdtf32.exe" C:\Windows\SysWOW64\wmpdtf32.exe34⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD59703af3ac23b598954c27b06eac7a4a8
SHA1b67d5b23ae2d8f6a6c2a3b9814b4e99ca3d8ee7b
SHA256064c7a174d2b6379992817a7cb4e17ad522606c7950a16b47bed9d018b663aca
SHA5125f96438bd86452e3d50b912e0d026d13313cc8b49e52eac771cd5af237632a0dda80b8c39152fe0eaecc1baf4c0b2801bd6a111ec7b010c687e516deccd42be6