Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe
-
Size
235KB
-
MD5
b815adf1356fe79d0725d9206c4fe8de
-
SHA1
a3efc104cc279760ddc1352bfc18401ed370be45
-
SHA256
1a63c81d2139fdd80446640566d3453d8b3055f06041d1e8269b2ada78bd8933
-
SHA512
09228995cdffb79afa7adaa33fc711a4ae4db59759d161be6a7a8da7e8695948b45adb5720ab3d418767184c992bb185bdfdf095e0fefedd7919b2fa0725dc85
-
SSDEEP
3072:IUgB1IDkLnDaj0lTjCHCzdtZ8pmuaJlQwvV0ruNbAFQUTkscK80YlOJD1:KBrDDaj0lPqKFDJlQ0cmAGClKK1
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 62 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe Key value queried \REGISTRY\USER\S-1-5-21-3630502724-2561614198-3854231964-1000\Control Panel\International\Geo\Nation wmiptsd.exe -
Deletes itself 1 IoCs
pid Process 4584 wmiptsd.exe -
Executes dropped EXE 64 IoCs
pid Process 4260 wmiptsd.exe 4584 wmiptsd.exe 4576 wmiptsd.exe 4476 wmiptsd.exe 3652 wmiptsd.exe 1852 wmiptsd.exe 4784 wmiptsd.exe 5020 wmiptsd.exe 2820 wmiptsd.exe 3928 wmiptsd.exe 4416 wmiptsd.exe 2672 wmiptsd.exe 5444 wmiptsd.exe 3128 wmiptsd.exe 5928 wmiptsd.exe 5668 wmiptsd.exe 5320 wmiptsd.exe 2544 wmiptsd.exe 1080 wmiptsd.exe 1512 wmiptsd.exe 1164 wmiptsd.exe 5584 wmiptsd.exe 2800 wmiptsd.exe 4668 wmiptsd.exe 2764 wmiptsd.exe 5284 wmiptsd.exe 1048 wmiptsd.exe 5764 wmiptsd.exe 3940 wmiptsd.exe 4348 wmiptsd.exe 2276 wmiptsd.exe 5260 wmiptsd.exe 1056 wmiptsd.exe 1656 wmiptsd.exe 3904 wmiptsd.exe 5476 wmiptsd.exe 4712 wmiptsd.exe 5432 wmiptsd.exe 1888 wmiptsd.exe 5572 wmiptsd.exe 4320 wmiptsd.exe 920 wmiptsd.exe 212 wmiptsd.exe 4204 wmiptsd.exe 4252 wmiptsd.exe 64 wmiptsd.exe 5600 wmiptsd.exe 3556 wmiptsd.exe 4312 wmiptsd.exe 4500 wmiptsd.exe 4716 wmiptsd.exe 4856 wmiptsd.exe 4192 wmiptsd.exe 5660 wmiptsd.exe 4884 wmiptsd.exe 4892 wmiptsd.exe 1172 wmiptsd.exe 3788 wmiptsd.exe 6024 wmiptsd.exe 5592 wmiptsd.exe 4988 wmiptsd.exe 5016 wmiptsd.exe 4888 wmiptsd.exe 5540 wmiptsd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File opened for modification C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe File created C:\Windows\SysWOW64\wmiptsd.exe wmiptsd.exe -
Suspicious use of SetThreadContext 61 IoCs
description pid Process procid_target PID 2316 set thread context of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 4260 set thread context of 4584 4260 wmiptsd.exe 91 PID 4576 set thread context of 4476 4576 wmiptsd.exe 94 PID 3652 set thread context of 1852 3652 wmiptsd.exe 96 PID 4784 set thread context of 5020 4784 wmiptsd.exe 98 PID 2820 set thread context of 3928 2820 wmiptsd.exe 100 PID 4416 set thread context of 2672 4416 wmiptsd.exe 102 PID 5444 set thread context of 3128 5444 wmiptsd.exe 104 PID 5928 set thread context of 5668 5928 wmiptsd.exe 106 PID 5320 set thread context of 2544 5320 wmiptsd.exe 108 PID 1080 set thread context of 1512 1080 wmiptsd.exe 110 PID 1164 set thread context of 5584 1164 wmiptsd.exe 112 PID 2800 set thread context of 4668 2800 wmiptsd.exe 114 PID 2764 set thread context of 5284 2764 wmiptsd.exe 118 PID 1048 set thread context of 5764 1048 wmiptsd.exe 120 PID 3940 set thread context of 4348 3940 wmiptsd.exe 123 PID 2276 set thread context of 5260 2276 wmiptsd.exe 125 PID 1056 set thread context of 1656 1056 wmiptsd.exe 127 PID 3904 set thread context of 5476 3904 wmiptsd.exe 129 PID 4712 set thread context of 5432 4712 wmiptsd.exe 131 PID 1888 set thread context of 5572 1888 wmiptsd.exe 133 PID 4320 set thread context of 920 4320 wmiptsd.exe 135 PID 212 set thread context of 4204 212 wmiptsd.exe 137 PID 4252 set thread context of 64 4252 wmiptsd.exe 139 PID 5600 set thread context of 3556 5600 wmiptsd.exe 141 PID 4312 set thread context of 4500 4312 wmiptsd.exe 143 PID 4716 set thread context of 4856 4716 wmiptsd.exe 145 PID 4192 set thread context of 5660 4192 wmiptsd.exe 147 PID 4884 set thread context of 4892 4884 wmiptsd.exe 149 PID 1172 set thread context of 3788 1172 wmiptsd.exe 151 PID 6024 set thread context of 5592 6024 wmiptsd.exe 153 PID 4988 set thread context of 5016 4988 wmiptsd.exe 155 PID 4888 set thread context of 5540 4888 wmiptsd.exe 157 PID 4932 set thread context of 4940 4932 wmiptsd.exe 159 PID 3388 set thread context of 1636 3388 wmiptsd.exe 161 PID 4304 set thread context of 2492 4304 wmiptsd.exe 163 PID 5224 set thread context of 548 5224 wmiptsd.exe 165 PID 3440 set thread context of 1544 3440 wmiptsd.exe 167 PID 2448 set thread context of 2196 2448 wmiptsd.exe 169 PID 376 set thread context of 5192 376 wmiptsd.exe 171 PID 3120 set thread context of 5392 3120 wmiptsd.exe 173 PID 2564 set thread context of 1320 2564 wmiptsd.exe 175 PID 4420 set thread context of 3968 4420 wmiptsd.exe 177 PID 2256 set thread context of 2180 2256 wmiptsd.exe 179 PID 5960 set thread context of 2616 5960 wmiptsd.exe 181 PID 5292 set thread context of 2916 5292 wmiptsd.exe 183 PID 1612 set thread context of 4048 1612 wmiptsd.exe 185 PID 2072 set thread context of 3692 2072 wmiptsd.exe 187 PID 3920 set thread context of 4164 3920 wmiptsd.exe 189 PID 5604 set thread context of 5276 5604 wmiptsd.exe 191 PID 5980 set thread context of 5360 5980 wmiptsd.exe 193 PID 5736 set thread context of 2952 5736 wmiptsd.exe 197 PID 5348 set thread context of 2324 5348 wmiptsd.exe 199 PID 5248 set thread context of 976 5248 wmiptsd.exe 201 PID 5092 set thread context of 4688 5092 wmiptsd.exe 203 PID 4708 set thread context of 4260 4708 wmiptsd.exe 205 PID 4716 set thread context of 3196 4716 wmiptsd.exe 207 PID 4860 set thread context of 4576 4860 wmiptsd.exe 209 PID 4608 set thread context of 2108 4608 wmiptsd.exe 211 PID 3628 set thread context of 2932 3628 wmiptsd.exe 213 PID 5472 set thread context of 1752 5472 wmiptsd.exe 215 -
resource yara_rule behavioral1/memory/4428-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4428-2-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4428-3-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4428-4-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4428-38-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4584-43-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4584-44-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4584-45-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4584-47-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4476-53-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1852-61-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5020-68-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3928-75-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2672-80-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2672-82-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3128-90-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5668-96-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2544-102-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2544-105-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1512-112-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5584-119-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4668-128-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5284-136-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5764-144-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4348-152-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5260-160-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1656-168-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5476-176-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5432-184-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5572-192-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/920-201-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4204-207-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/64-213-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3556-219-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4500-225-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4856-231-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5660-237-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4892-243-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3788-249-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5592-255-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5016-261-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5540-267-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4940-273-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1636-279-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2492-285-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/548-291-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1544-297-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2196-303-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5192-309-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5392-313-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5392-316-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1320-322-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3968-328-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2180-334-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2616-340-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2916-346-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4048-352-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/3692-358-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4164-364-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5276-370-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/5360-376-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/4308-381-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2952-387-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/2324-393-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmiptsd.exe -
Modifies registry class 62 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmiptsd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 4428 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 4584 wmiptsd.exe 4584 wmiptsd.exe 4476 wmiptsd.exe 4476 wmiptsd.exe 1852 wmiptsd.exe 1852 wmiptsd.exe 5020 wmiptsd.exe 5020 wmiptsd.exe 3928 wmiptsd.exe 3928 wmiptsd.exe 2672 wmiptsd.exe 2672 wmiptsd.exe 3128 wmiptsd.exe 3128 wmiptsd.exe 5668 wmiptsd.exe 5668 wmiptsd.exe 2544 wmiptsd.exe 2544 wmiptsd.exe 1512 wmiptsd.exe 1512 wmiptsd.exe 5584 wmiptsd.exe 5584 wmiptsd.exe 4668 wmiptsd.exe 4668 wmiptsd.exe 5284 wmiptsd.exe 5284 wmiptsd.exe 5764 wmiptsd.exe 5764 wmiptsd.exe 4348 wmiptsd.exe 4348 wmiptsd.exe 5260 wmiptsd.exe 5260 wmiptsd.exe 1656 wmiptsd.exe 1656 wmiptsd.exe 5476 wmiptsd.exe 5476 wmiptsd.exe 5432 wmiptsd.exe 5432 wmiptsd.exe 5572 wmiptsd.exe 5572 wmiptsd.exe 920 wmiptsd.exe 920 wmiptsd.exe 4204 wmiptsd.exe 4204 wmiptsd.exe 64 wmiptsd.exe 64 wmiptsd.exe 3556 wmiptsd.exe 3556 wmiptsd.exe 4500 wmiptsd.exe 4500 wmiptsd.exe 4856 wmiptsd.exe 4856 wmiptsd.exe 5660 wmiptsd.exe 5660 wmiptsd.exe 4892 wmiptsd.exe 4892 wmiptsd.exe 3788 wmiptsd.exe 3788 wmiptsd.exe 5592 wmiptsd.exe 5592 wmiptsd.exe 5016 wmiptsd.exe 5016 wmiptsd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 2316 wrote to memory of 4428 2316 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 88 PID 4428 wrote to memory of 4260 4428 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 89 PID 4428 wrote to memory of 4260 4428 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 89 PID 4428 wrote to memory of 4260 4428 JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe 89 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4260 wrote to memory of 4584 4260 wmiptsd.exe 91 PID 4584 wrote to memory of 4576 4584 wmiptsd.exe 93 PID 4584 wrote to memory of 4576 4584 wmiptsd.exe 93 PID 4584 wrote to memory of 4576 4584 wmiptsd.exe 93 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4576 wrote to memory of 4476 4576 wmiptsd.exe 94 PID 4476 wrote to memory of 3652 4476 wmiptsd.exe 95 PID 4476 wrote to memory of 3652 4476 wmiptsd.exe 95 PID 4476 wrote to memory of 3652 4476 wmiptsd.exe 95 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 3652 wrote to memory of 1852 3652 wmiptsd.exe 96 PID 1852 wrote to memory of 4784 1852 wmiptsd.exe 97 PID 1852 wrote to memory of 4784 1852 wmiptsd.exe 97 PID 1852 wrote to memory of 4784 1852 wmiptsd.exe 97 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 4784 wrote to memory of 5020 4784 wmiptsd.exe 98 PID 5020 wrote to memory of 2820 5020 wmiptsd.exe 99 PID 5020 wrote to memory of 2820 5020 wmiptsd.exe 99 PID 5020 wrote to memory of 2820 5020 wmiptsd.exe 99 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 2820 wrote to memory of 3928 2820 wmiptsd.exe 100 PID 3928 wrote to memory of 4416 3928 wmiptsd.exe 101 PID 3928 wrote to memory of 4416 3928 wmiptsd.exe 101 PID 3928 wrote to memory of 4416 3928 wmiptsd.exe 101 PID 4416 wrote to memory of 2672 4416 wmiptsd.exe 102 PID 4416 wrote to memory of 2672 4416 wmiptsd.exe 102 PID 4416 wrote to memory of 2672 4416 wmiptsd.exe 102 PID 4416 wrote to memory of 2672 4416 wmiptsd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b815adf1356fe79d0725d9206c4fe8de.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2672 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5444 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3128 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5668 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5320 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2544 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1080 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5584 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2800 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4668 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5284 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5764 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3940 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5260 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3904 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5476 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4712 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5432 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1888 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5572 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:920 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:212 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4204 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4252 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:64 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3556 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4312 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4500 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4716 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4856 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4192 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5660 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4884 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4892 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3788 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6024 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5592 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5016 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5540 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe67⤵
- Suspicious use of SetThreadContext
PID:4932 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe68⤵
- Checks computer location settings
- Modifies registry class
PID:4940 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe70⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1636 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe71⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe72⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2492 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe73⤵
- Suspicious use of SetThreadContext
PID:5224 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe74⤵
- Checks computer location settings
- Modifies registry class
PID:548 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe76⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1544 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe77⤵
- Suspicious use of SetThreadContext
PID:2448 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe78⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe79⤵
- Suspicious use of SetThreadContext
PID:376 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe80⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:5192 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe81⤵
- Suspicious use of SetThreadContext
PID:3120 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe82⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5392 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe83⤵
- Suspicious use of SetThreadContext
PID:2564 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe84⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1320 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe85⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe86⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3968 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe87⤵
- Suspicious use of SetThreadContext
PID:2256 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe88⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2180 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe89⤵
- Suspicious use of SetThreadContext
PID:5960 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe90⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe91⤵
- Suspicious use of SetThreadContext
PID:5292 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe92⤵
- Checks computer location settings
- Modifies registry class
PID:2916 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe94⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4048 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe95⤵
- Suspicious use of SetThreadContext
PID:2072 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe96⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3692 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe97⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3920 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe98⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4164 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe99⤵
- Suspicious use of SetThreadContext
PID:5604 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe100⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:5276 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe102⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5360 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe103⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe104⤵
- Checks computer location settings
- Modifies registry class
PID:4308 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe105⤵
- Suspicious use of SetThreadContext
PID:5736 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe106⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:2952 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe107⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe108⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2324 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe109⤵
- Suspicious use of SetThreadContext
PID:5248 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe110⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:976 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe111⤵
- Suspicious use of SetThreadContext
PID:5092 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe112⤵
- Checks computer location settings
- Modifies registry class
PID:4688 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe113⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe114⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:4260 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe115⤵
- Suspicious use of SetThreadContext
PID:4716 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe116⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3196 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe117⤵
- Suspicious use of SetThreadContext
PID:4860 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe118⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4576 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe119⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\SysWOW64\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe120⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2108 -
C:\Windows\SysWOW64\wmiptsd.exe"C:\Windows\system32\wmiptsd.exe" C:\Windows\SysWOW64\wmiptsd.exe121⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-