230d5503e16ed4bfec303104ae5f9a4e1a6ef4f67753b91150ef68caaacc9d5e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.act.exe
Size 9KB
Sample261006-plcbcagv5y
SHA256 230d5503e16ed4bfec303104ae5f9a4e1a6ef4f67753b91150ef68caaacc9d5e
MD5 cb7e13059244565119e58d41319c8ba1
SHA1 a962eafa796aaf39b07de89704ac15dbaf32fbf6
SHA512 2311bae3c6cb90014d1eb4d2f8a1be74481288d36324c9f71fcf63f9c309834dc033ca4dbaa7d0602b8daf3cee74501de604ea18e4e00c5c63c6ffddeccaa8d9
SSDEEP 192:jPMsSp3ioEGgmGHirDigHv/LFoR/ZFJ/RPciNXSJP3nlST7k:jksS1ioT+iisLi/ZFNrRuP3nt
TLSH
T1D8128DE7093F652BD48BE2785581E04768F83C74637961B9344F8372AC84E972728B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

Executes dropped EXE 49 IoCs

pid	Process
3376	msdview32.exe
5084	msdview32.exe
3220	msdview32.exe
5932	msdview32.exe
3280	msdview32.exe
2716	msdview32.exe
5692	msdview32.exe
5104	msdview32.exe
1336	msdview32.exe
4540	msdview32.exe
572	msdview32.exe
5408	msdview32.exe
3132	msdview32.exe
1272	msdview32.exe
4640	msdview32.exe
4268	msdview32.exe
3276	msdview32.exe
5044	msdview32.exe
3824	msdview32.exe
3820	msdview32.exe
5100	msdview32.exe
2480	msdview32.exe
3324	msdview32.exe
1268	msdview32.exe
5912	msdview32.exe
4608	msdview32.exe
5452	msdview32.exe
3668	msdview32.exe
2484	msdview32.exe
3284	msdview32.exe
2384	msdview32.exe
3636	msdview32.exe
2492	msdview32.exe
4260	msdview32.exe
4200	msdview32.exe
796	msdview32.exe
2924	msdview32.exe
5756	msdview32.exe
828	msdview32.exe
2632	msdview32.exe
5884	msdview32.exe
1584	msdview32.exe
4136	msdview32.exe
4076	msdview32.exe
2372	msdview32.exe
2268	msdview32.exe
4984	msdview32.exe
5376	msdview32.exe
4116	msdview32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	jaffacakes118_Trojan-Downloader.Win32.Small.act.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File created	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe
File opened for modification	C:\Windows\SysWOW64\msdview32.exe	msdview32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2948-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000500000000053e-1.dat	upx
behavioral2/memory/2948-3-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3824-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Small.act.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msdview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3376	2948	jaffacakes118_Trojan-Downloader.Win32.Small.act.exe	91
PID 3376 wrote to memory of 5084	3376	msdview32.exe	92
PID 5084 wrote to memory of 3220	5084	msdview32.exe	93
PID 3220 wrote to memory of 5932	3220	msdview32.exe	94
PID 5932 wrote to memory of 3280	5932	msdview32.exe	95
PID 3280 wrote to memory of 2716	3280	msdview32.exe	97
PID 2716 wrote to memory of 5692	2716	msdview32.exe	98
PID 5692 wrote to memory of 5104	5692	msdview32.exe	99
PID 5104 wrote to memory of 1336	5104	msdview32.exe	100
PID 1336 wrote to memory of 4540	1336	msdview32.exe	102
PID 4540 wrote to memory of 572	4540	msdview32.exe	103
PID 2948 wrote to memory of 5224	2948	jaffacakes118_Trojan-Downloader.Win32.Small.act.exe	104
PID 572 wrote to memory of 5408	572	msdview32.exe	106
PID 3376 wrote to memory of 2020	3376	msdview32.exe	107
PID 5408 wrote to memory of 3132	5408	msdview32.exe	109
PID 5084 wrote to memory of 4372	5084	msdview32.exe	110
PID 3132 wrote to memory of 1272	3132	msdview32.exe	112
PID 3220 wrote to memory of 4552	3220	msdview32.exe	113
PID 1272 wrote to memory of 4640	1272	msdview32.exe	115
PID 5932 wrote to memory of 6084	5932	msdview32.exe	116
PID 4640 wrote to memory of 4268	4640	msdview32.exe	118
PID 3280 wrote to memory of 1060	3280	msdview32.exe	119
PID 4268 wrote to memory of 3276	4268	msdview32.exe	121
PID 2716 wrote to memory of 1716	2716	msdview32.exe	122
PID 3276 wrote to memory of 5044	3276	msdview32.exe	124
PID 5692 wrote to memory of 5144	5692	msdview32.exe	125
PID 5044 wrote to memory of 3824	5044	msdview32.exe	127
PID 5104 wrote to memory of 6128	5104	msdview32.exe	128
PID 3824 wrote to memory of 3820	3824	msdview32.exe	130
PID 1336 wrote to memory of 5660	1336	msdview32.exe	131
PID 3820 wrote to memory of 5100	3820	msdview32.exe	133
PID 4540 wrote to memory of 2872	4540	msdview32.exe	134
PID 5100 wrote to memory of 2480	5100	msdview32.exe	136
PID 572 wrote to memory of 4812	572	msdview32.exe	137
PID 2480 wrote to memory of 3324	2480	msdview32.exe	139
PID 5408 wrote to memory of 5308	5408	msdview32.exe	140
PID 3324 wrote to memory of 1268	3324	msdview32.exe	142
PID 3132 wrote to memory of 5260	3132	msdview32.exe	143
PID 1268 wrote to memory of 5912	1268	msdview32.exe	145
PID 1272 wrote to memory of 2984	1272	msdview32.exe	146
PID 5912 wrote to memory of 4608	5912	msdview32.exe	148
PID 4640 wrote to memory of 2428	4640	msdview32.exe	149
PID 4608 wrote to memory of 5452	4608	msdview32.exe	151
PID 4268 wrote to memory of 3816	4268	msdview32.exe	152
PID 5452 wrote to memory of 3668	5452	msdview32.exe	154
PID 3276 wrote to memory of 1292	3276	msdview32.exe	155
PID 3668 wrote to memory of 2484	3668	msdview32.exe	157
PID 5044 wrote to memory of 5896	5044	msdview32.exe	158
PID 2484 wrote to memory of 3284	2484	msdview32.exe	160
PID 3824 wrote to memory of 3240	3824	msdview32.exe	161
PID 3284 wrote to memory of 2384	3284	msdview32.exe	163
PID 3820 wrote to memory of 1280	3820	msdview32.exe	164
PID 2384 wrote to memory of 3636	2384	msdview32.exe	166
PID 5100 wrote to memory of 3224	5100	msdview32.exe	167
PID 3636 wrote to memory of 2492	3636	msdview32.exe	169
PID 2480 wrote to memory of 2352	2480	msdview32.exe	170
PID 2492 wrote to memory of 4260	2492	msdview32.exe	172
PID 3324 wrote to memory of 3412	3324	msdview32.exe	173
PID 4260 wrote to memory of 4200	4260	msdview32.exe	175
PID 1268 wrote to memory of 4916	1268	msdview32.exe	176
PID 4200 wrote to memory of 796	4200	msdview32.exe	178
PID 5912 wrote to memory of 2780	5912	msdview32.exe	179
PID 796 wrote to memory of 2924	796	msdview32.exe	181
PID 4608 wrote to memory of 3680	4608	msdview32.exe	182

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.act.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.act.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\msdview32.exe
  C:\Windows\system32\msdview32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\msdview32.exe
    C:\Windows\system32\msdview32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\SysWOW64\msdview32.exe
      C:\Windows\system32\msdview32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5932
      - C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5408
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2632
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\msdview32.exe
        
        C:\Windows\system32\msdview32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        40⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        39⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        37⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        34⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        28⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        25⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        17⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        12⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        11⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        10⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        9⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        7⤵
        
        PID:1060
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\MSDVIE~1.EXE >> NUL
    3⤵
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msdview32.exe

Path C:\Windows\SysWOW64\msdview32.exe
Size 9KB
SHA256 230d5503e16ed4bfec303104ae5f9a4e1a6ef4f67753b91150ef68caaacc9d5e
MD5 cb7e13059244565119e58d41319c8ba1
SHA1 a962eafa796aaf39b07de89704ac15dbaf32fbf6
SHA512 2311bae3c6cb90014d1eb4d2f8a1be74481288d36324c9f71fcf63f9c309834dc033ca4dbaa7d0602b8daf3cee74501de604ea18e4e00c5c63c6ffddeccaa8d9
SSDEEP 192:jPMsSp3ioEGgmGHirDigHv/LFoR/ZFJ/RPciNXSJP3nlST7k:jksS1ioT+iisLi/ZFNrRuP3nt
TLSH
T1D8128DE7093F652BD48BE2785581E04768F83C74637961B9344F8372AC84E972728B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2948-3-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3824-68-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads