60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe
Size 14KB
Sample260924-dynz5ada28
SHA256 60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f
MD5 e3b30de03352252057f53a4cd9253089
SHA1 41d79374f43f9fe8055bff0b4ad359533d26c501
SHA512 bb4389286dee87dbb67fbf716368730000dcd0b24e07a586a7ec1df6c545b29dcefe911b9d9dc3485056714ac1779aa3ee21fa600631ec669dff23da5202e968
SSDEEP 192:joMuqwLjEzymTGfNX1SMvJtOZqsx+obMgPwmnSi6dQ/H/eohyoH+OkV5Y/mB4aDS:jJOSqsrxmriPyP7HHDHACT1Lm
TLSH
T1FF626C03AA8408F2E9C4027905D9B63F7B3F916412B1ED479F14C99A8D376D362BC19E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 49 IoCs

pid	Process
3216	msdview32.exe
2848	msdview32.exe
3008	msdview32.exe
2916	msdview32.exe
3048	msdview32.exe
5528	msdview32.exe
3668	msdview32.exe
5192	msdview32.exe
1136	msdview32.exe
1596	msdview32.exe
3856	msdview32.exe
5720	msdview32.exe
2356	msdview32.exe
5560	msdview32.exe
1620	msdview32.exe
2880	msdview32.exe
2620	msdview32.exe
3028	msdview32.exe
3240	msdview32.exe
4556	msdview32.exe
1964	msdview32.exe
4532	msdview32.exe
3128	msdview32.exe
5636	msdview32.exe
4364	msdview32.exe
4104	msdview32.exe
5756	msdview32.exe
2672	msdview32.exe
5304	msdview32.exe
2800	msdview32.exe
2080	msdview32.exe
824	msdview32.exe
4520	msdview32.exe
3704	msdview32.exe
1652	msdview32.exe
2088	msdview32.exe
940	msdview32.exe
3428	msdview32.exe
6032	msdview32.exe
3404	msdview32.exe
2440	msdview32.exe
1432	msdview32.exe
3764	msdview32.exe
5256	msdview32.exe
3592	msdview32.exe
3628	msdview32.exe
980	msdview32.exe
844	msdview32.exe
2936	msdview32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3216	4080	jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe	90
PID 3216 wrote to memory of 2848	3216	msdview32.exe	91
PID 2848 wrote to memory of 3008	2848	msdview32.exe	92
PID 3008 wrote to memory of 2916	3008	msdview32.exe	93
PID 2916 wrote to memory of 3048	2916	msdview32.exe	94
PID 3048 wrote to memory of 5528	3048	msdview32.exe	95
PID 5528 wrote to memory of 3668	5528	msdview32.exe	96
PID 3668 wrote to memory of 5192	3668	msdview32.exe	97
PID 5192 wrote to memory of 1136	5192	msdview32.exe	98
PID 1136 wrote to memory of 1596	1136	msdview32.exe	100
PID 1596 wrote to memory of 3856	1596	msdview32.exe	101
PID 4080 wrote to memory of 2844	4080	jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe	102
PID 3856 wrote to memory of 5720	3856	msdview32.exe	104
PID 3216 wrote to memory of 1536	3216	msdview32.exe	105
PID 5720 wrote to memory of 2356	5720	msdview32.exe	107
PID 2848 wrote to memory of 2232	2848	msdview32.exe	108
PID 2356 wrote to memory of 5560	2356	msdview32.exe	110
PID 3008 wrote to memory of 1436	3008	msdview32.exe	111
PID 5560 wrote to memory of 1620	5560	msdview32.exe	113
PID 2916 wrote to memory of 5328	2916	msdview32.exe	114
PID 1620 wrote to memory of 2880	1620	msdview32.exe	116
PID 3048 wrote to memory of 1652	3048	msdview32.exe	117
PID 2880 wrote to memory of 2620	2880	msdview32.exe	119
PID 5528 wrote to memory of 2088	5528	msdview32.exe	120
PID 2620 wrote to memory of 3028	2620	msdview32.exe	122
PID 3668 wrote to memory of 940	3668	msdview32.exe	123
PID 3028 wrote to memory of 3240	3028	msdview32.exe	125
PID 5192 wrote to memory of 5864	5192	msdview32.exe	126
PID 3240 wrote to memory of 4556	3240	msdview32.exe	128
PID 1136 wrote to memory of 2120	1136	msdview32.exe	129
PID 4556 wrote to memory of 1964	4556	msdview32.exe	131
PID 1596 wrote to memory of 616	1596	msdview32.exe	132
PID 1964 wrote to memory of 4532	1964	msdview32.exe	134
PID 3856 wrote to memory of 5000	3856	msdview32.exe	135
PID 4532 wrote to memory of 3128	4532	msdview32.exe	137
PID 5720 wrote to memory of 3052	5720	msdview32.exe	138
PID 3128 wrote to memory of 5636	3128	msdview32.exe	140
PID 2356 wrote to memory of 3364	2356	msdview32.exe	141
PID 5636 wrote to memory of 4364	5636	msdview32.exe	143
PID 5560 wrote to memory of 5264	5560	msdview32.exe	144
PID 4364 wrote to memory of 4104	4364	msdview32.exe	146
PID 1620 wrote to memory of 4276	1620	msdview32.exe	147
PID 4104 wrote to memory of 5756	4104	msdview32.exe	149
PID 2880 wrote to memory of 4740	2880	msdview32.exe	150
PID 5756 wrote to memory of 2672	5756	msdview32.exe	152
PID 2620 wrote to memory of 260	2620	msdview32.exe	153
PID 2672 wrote to memory of 5304	2672	msdview32.exe	155
PID 3028 wrote to memory of 5976	3028	msdview32.exe	156
PID 5304 wrote to memory of 2800	5304	msdview32.exe	158
PID 3240 wrote to memory of 2504	3240	msdview32.exe	159
PID 2800 wrote to memory of 2080	2800	msdview32.exe	161
PID 4556 wrote to memory of 1516	4556	msdview32.exe	162
PID 2080 wrote to memory of 824	2080	msdview32.exe	164
PID 1964 wrote to memory of 6112	1964	msdview32.exe	165
PID 824 wrote to memory of 4520	824	msdview32.exe	167
PID 4532 wrote to memory of 5948	4532	msdview32.exe	168
PID 4520 wrote to memory of 3704	4520	msdview32.exe	170
PID 3128 wrote to memory of 1796	3128	msdview32.exe	171
PID 3704 wrote to memory of 1652	3704	msdview32.exe	173
PID 5636 wrote to memory of 5632	5636	msdview32.exe	174
PID 1652 wrote to memory of 2088	1652	msdview32.exe	176
PID 4364 wrote to memory of 4568	4364	msdview32.exe	177
PID 2088 wrote to memory of 940	2088	msdview32.exe	179
PID 4104 wrote to memory of 4876	4104	msdview32.exe	180

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\msdview32.exe
  C:\Windows\system32\msdview32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\msdview32.exe
    C:\Windows\system32\msdview32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\msdview32.exe
      C:\Windows\system32\msdview32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5192
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:940
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3764
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3592
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:844
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        50⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        40⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        39⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        38⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        37⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        35⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        31⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        28⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        26⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        17⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:3364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        9⤵
        
        PID:940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        8⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        5⤵
        
        PID:1436
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msdview32.exe

Path C:\Windows\SysWOW64\msdview32.exe
Size 14KB
SHA256 60af72b682741c6cc34aed9c02e1dcd59348c2b02dd564c92204892996090a0f
MD5 e3b30de03352252057f53a4cd9253089
SHA1 41d79374f43f9fe8055bff0b4ad359533d26c501
SHA512 bb4389286dee87dbb67fbf716368730000dcd0b24e07a586a7ec1df6c545b29dcefe911b9d9dc3485056714ac1779aa3ee21fa600631ec669dff23da5202e968
SSDEEP 192:joMuqwLjEzymTGfNX1SMvJtOZqsx+obMgPwmnSi6dQ/H/eohyoH+OkV5Y/mB4aDS:jJOSqsrxmriPyP7HHDHACT1Lm
TLSH
T1FF626C03AA8408F2E9C4027905D9B63F7B3F916412B1ED479F14C99A8D376D362BC19E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download