Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 06:03
Static task
static1
Behavioral task
behavioral1
Sample
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe
-
Size
199KB
-
MD5
190aeb317f6c7f6956952327d719b007
-
SHA1
b07675d4f7f4dbbf6c89ad0264362015c36f192c
-
SHA256
861290cab7f4bac049a7b19693e2acdda58dbd5b0dbebedc2e803f9a6476a571
-
SHA512
76a837995952890ea050b41586030f87c4c143ce0f1134a94e28c4a969d3335dbd7910f7b132b70ae573f3e5e07d642858f5f1c13118a4c02130205b37d461d0
-
SSDEEP
3072:NdmO0+1JiNRHw7PXppxRzd2NLGM61pTz2FreEErROmLPBadoWaK9YvxUDhfm:DSrRHw7fEx8pGFrl2RjLPBaOTSDA
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
wmpdtc32.exepid process 2684 wmpdtc32.exe -
Executes dropped EXE 32 IoCs
Processes:
wmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exepid process 2996 wmpdtc32.exe 2684 wmpdtc32.exe 2492 wmpdtc32.exe 2564 wmpdtc32.exe 2144 wmpdtc32.exe 1660 wmpdtc32.exe 1520 wmpdtc32.exe 1688 wmpdtc32.exe 2916 wmpdtc32.exe 2876 wmpdtc32.exe 2236 wmpdtc32.exe 1740 wmpdtc32.exe 2468 wmpdtc32.exe 1028 wmpdtc32.exe 2060 wmpdtc32.exe 2420 wmpdtc32.exe 2956 wmpdtc32.exe 2988 wmpdtc32.exe 1920 wmpdtc32.exe 1752 wmpdtc32.exe 2596 wmpdtc32.exe 2704 wmpdtc32.exe 2536 wmpdtc32.exe 2692 wmpdtc32.exe 1528 wmpdtc32.exe 748 wmpdtc32.exe 2380 wmpdtc32.exe 2392 wmpdtc32.exe 2760 wmpdtc32.exe 2344 wmpdtc32.exe 1800 wmpdtc32.exe 2456 wmpdtc32.exe -
Loads dropped DLL 32 IoCs
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exepid process 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 2996 wmpdtc32.exe 2684 wmpdtc32.exe 2492 wmpdtc32.exe 2564 wmpdtc32.exe 2144 wmpdtc32.exe 1660 wmpdtc32.exe 1520 wmpdtc32.exe 1688 wmpdtc32.exe 2916 wmpdtc32.exe 2876 wmpdtc32.exe 2236 wmpdtc32.exe 1740 wmpdtc32.exe 2468 wmpdtc32.exe 1028 wmpdtc32.exe 2060 wmpdtc32.exe 2420 wmpdtc32.exe 2956 wmpdtc32.exe 2988 wmpdtc32.exe 1920 wmpdtc32.exe 1752 wmpdtc32.exe 2596 wmpdtc32.exe 2704 wmpdtc32.exe 2536 wmpdtc32.exe 2692 wmpdtc32.exe 1528 wmpdtc32.exe 748 wmpdtc32.exe 2380 wmpdtc32.exe 2392 wmpdtc32.exe 2760 wmpdtc32.exe 2344 wmpdtc32.exe 1800 wmpdtc32.exe -
Processes:
resource yara_rule behavioral1/memory/2216-4-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-9-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-8-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-7-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-6-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-3-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-2-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2216-19-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2684-30-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2684-29-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2684-32-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2684-31-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2684-37-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2564-49-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2564-54-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1660-66-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1660-72-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1688-83-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1688-84-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1688-82-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1688-89-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2876-101-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2876-107-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1740-119-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1740-124-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1028-136-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1028-142-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2420-154-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2420-159-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2988-171-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2988-177-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1752-189-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1752-194-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2704-206-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2704-212-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2692-224-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2692-229-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/748-241-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/748-247-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2392-259-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2392-262-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2344-272-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2344-275-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2456-285-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 34 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdtc32.exe -
Drops file in System32 directory 48 IoCs
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exedescription ioc process File created C:\Windows\SysWOW64\wmpdtc32.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe File opened for modification C:\Windows\SysWOW64\ wmpdtc32.exe File created C:\Windows\SysWOW64\wmpdtc32.exe wmpdtc32.exe -
Suspicious use of SetThreadContext 17 IoCs
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exedescription pid process target process PID 1920 set thread context of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 2996 set thread context of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2492 set thread context of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2144 set thread context of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 1520 set thread context of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 2916 set thread context of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2236 set thread context of 1740 2236 wmpdtc32.exe wmpdtc32.exe PID 2468 set thread context of 1028 2468 wmpdtc32.exe wmpdtc32.exe PID 2060 set thread context of 2420 2060 wmpdtc32.exe wmpdtc32.exe PID 2956 set thread context of 2988 2956 wmpdtc32.exe wmpdtc32.exe PID 1920 set thread context of 1752 1920 wmpdtc32.exe wmpdtc32.exe PID 2596 set thread context of 2704 2596 wmpdtc32.exe wmpdtc32.exe PID 2536 set thread context of 2692 2536 wmpdtc32.exe wmpdtc32.exe PID 1528 set thread context of 748 1528 wmpdtc32.exe wmpdtc32.exe PID 2380 set thread context of 2392 2380 wmpdtc32.exe wmpdtc32.exe PID 2760 set thread context of 2344 2760 wmpdtc32.exe wmpdtc32.exe PID 1800 set thread context of 2456 1800 wmpdtc32.exe wmpdtc32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exepid process 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 2684 wmpdtc32.exe 2684 wmpdtc32.exe 2564 wmpdtc32.exe 2564 wmpdtc32.exe 1660 wmpdtc32.exe 1660 wmpdtc32.exe 1688 wmpdtc32.exe 1688 wmpdtc32.exe 2876 wmpdtc32.exe 2876 wmpdtc32.exe 1740 wmpdtc32.exe 1740 wmpdtc32.exe 1028 wmpdtc32.exe 1028 wmpdtc32.exe 2420 wmpdtc32.exe 2420 wmpdtc32.exe 2988 wmpdtc32.exe 2988 wmpdtc32.exe 1752 wmpdtc32.exe 1752 wmpdtc32.exe 2704 wmpdtc32.exe 2704 wmpdtc32.exe 2692 wmpdtc32.exe 2692 wmpdtc32.exe 748 wmpdtc32.exe 748 wmpdtc32.exe 2392 wmpdtc32.exe 2392 wmpdtc32.exe 2344 wmpdtc32.exe 2344 wmpdtc32.exe 2456 wmpdtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe190aeb317f6c7f6956952327d719b007_JaffaCakes118.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exewmpdtc32.exedescription pid process target process PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 1920 wrote to memory of 2216 1920 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe PID 2216 wrote to memory of 2996 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe wmpdtc32.exe PID 2216 wrote to memory of 2996 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe wmpdtc32.exe PID 2216 wrote to memory of 2996 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe wmpdtc32.exe PID 2216 wrote to memory of 2996 2216 190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2996 wrote to memory of 2684 2996 wmpdtc32.exe wmpdtc32.exe PID 2684 wrote to memory of 2492 2684 wmpdtc32.exe wmpdtc32.exe PID 2684 wrote to memory of 2492 2684 wmpdtc32.exe wmpdtc32.exe PID 2684 wrote to memory of 2492 2684 wmpdtc32.exe wmpdtc32.exe PID 2684 wrote to memory of 2492 2684 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2492 wrote to memory of 2564 2492 wmpdtc32.exe wmpdtc32.exe PID 2564 wrote to memory of 2144 2564 wmpdtc32.exe wmpdtc32.exe PID 2564 wrote to memory of 2144 2564 wmpdtc32.exe wmpdtc32.exe PID 2564 wrote to memory of 2144 2564 wmpdtc32.exe wmpdtc32.exe PID 2564 wrote to memory of 2144 2564 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 2144 wrote to memory of 1660 2144 wmpdtc32.exe wmpdtc32.exe PID 1660 wrote to memory of 1520 1660 wmpdtc32.exe wmpdtc32.exe PID 1660 wrote to memory of 1520 1660 wmpdtc32.exe wmpdtc32.exe PID 1660 wrote to memory of 1520 1660 wmpdtc32.exe wmpdtc32.exe PID 1660 wrote to memory of 1520 1660 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1520 wrote to memory of 1688 1520 wmpdtc32.exe wmpdtc32.exe PID 1688 wrote to memory of 2916 1688 wmpdtc32.exe wmpdtc32.exe PID 1688 wrote to memory of 2916 1688 wmpdtc32.exe wmpdtc32.exe PID 1688 wrote to memory of 2916 1688 wmpdtc32.exe wmpdtc32.exe PID 1688 wrote to memory of 2916 1688 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2916 wrote to memory of 2876 2916 wmpdtc32.exe wmpdtc32.exe PID 2876 wrote to memory of 2236 2876 wmpdtc32.exe wmpdtc32.exe PID 2876 wrote to memory of 2236 2876 wmpdtc32.exe wmpdtc32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\190aeb317f6c7f6956952327d719b007_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\190AEB~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Users\Admin\AppData\Local\Temp\190AEB~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpdtc32.exe"C:\Windows\system32\wmpdtc32.exe" C:\Windows\SysWOW64\wmpdtc32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpdtc32.exeFilesize
199KB
MD5190aeb317f6c7f6956952327d719b007
SHA1b07675d4f7f4dbbf6c89ad0264362015c36f192c
SHA256861290cab7f4bac049a7b19693e2acdda58dbd5b0dbebedc2e803f9a6476a571
SHA51276a837995952890ea050b41586030f87c4c143ce0f1134a94e28c4a969d3335dbd7910f7b132b70ae573f3e5e07d642858f5f1c13118a4c02130205b37d461d0
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/748-241-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/748-247-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1028-142-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1028-136-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1660-72-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1660-66-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1688-82-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1688-84-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1688-83-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1688-89-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1740-124-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1740-119-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1752-194-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1752-189-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-3-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-0-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-19-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-2-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-6-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-7-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-8-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-9-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2216-4-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2344-272-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2344-275-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2392-259-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2392-262-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2420-154-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2420-159-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2456-285-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2564-54-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2564-49-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2684-29-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2684-37-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2684-31-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2684-32-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2684-30-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2692-224-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2692-229-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2704-206-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2704-212-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2876-107-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2876-101-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2988-177-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2988-171-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB