Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe
-
Size
129KB
-
MD5
1a65f67b34573fc5611d04abacb1eb0d
-
SHA1
4c89ea6a0342ac4a54a9940132af406ea8a5644f
-
SHA256
4764c52d458b81c44ec06695acb16e8669ff758f3e28e7fc1488e1d79fb7fbbc
-
SHA512
999b023ebf5c041c8e8e3129cf3cca3ea06d4e3ac8325350ec44bc523edea93ce7ea15f487d5cccf104b3bd01537be4e76510f7c2364fa4e379e11b12a60acc6
-
SSDEEP
3072:ctPVDgXBYV9eCYS34uO/VGNtJvI6MJCyzjV:OGRYzN739O/ANzvWJX
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
wnfpt2.exepid process 2652 wnfpt2.exe -
Executes dropped EXE 54 IoCs
Processes:
wnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exepid process 2760 wnfpt2.exe 2652 wnfpt2.exe 2764 wnfpt2.exe 2540 wnfpt2.exe 2824 wnfpt2.exe 2880 wnfpt2.exe 1164 wnfpt2.exe 1348 wnfpt2.exe 1672 wnfpt2.exe 2828 wnfpt2.exe 316 wnfpt2.exe 1632 wnfpt2.exe 2616 wnfpt2.exe 2820 wnfpt2.exe 2340 wnfpt2.exe 2476 wnfpt2.exe 1356 wnfpt2.exe 1272 wnfpt2.exe 1712 wnfpt2.exe 2448 wnfpt2.exe 2072 wnfpt2.exe 2356 wnfpt2.exe 1992 wnfpt2.exe 1952 wnfpt2.exe 2796 wnfpt2.exe 2872 wnfpt2.exe 2428 wnfpt2.exe 2572 wnfpt2.exe 2980 wnfpt2.exe 3008 wnfpt2.exe 1888 wnfpt2.exe 1668 wnfpt2.exe 684 wnfpt2.exe 1044 wnfpt2.exe 596 wnfpt2.exe 2108 wnfpt2.exe 2248 wnfpt2.exe 2468 wnfpt2.exe 1092 wnfpt2.exe 1844 wnfpt2.exe 1648 wnfpt2.exe 1804 wnfpt2.exe 1712 wnfpt2.exe 2424 wnfpt2.exe 2016 wnfpt2.exe 2156 wnfpt2.exe 856 wnfpt2.exe 2484 wnfpt2.exe 1764 wnfpt2.exe 2788 wnfpt2.exe 2800 wnfpt2.exe 2656 wnfpt2.exe 2428 wnfpt2.exe 1816 wnfpt2.exe -
Loads dropped DLL 28 IoCs
Processes:
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exepid process 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 2760 wnfpt2.exe 2652 wnfpt2.exe 2540 wnfpt2.exe 2880 wnfpt2.exe 1348 wnfpt2.exe 2828 wnfpt2.exe 1632 wnfpt2.exe 2820 wnfpt2.exe 2476 wnfpt2.exe 1272 wnfpt2.exe 2448 wnfpt2.exe 2356 wnfpt2.exe 1952 wnfpt2.exe 2872 wnfpt2.exe 2572 wnfpt2.exe 3008 wnfpt2.exe 1668 wnfpt2.exe 1044 wnfpt2.exe 2108 wnfpt2.exe 2468 wnfpt2.exe 1844 wnfpt2.exe 1804 wnfpt2.exe 2424 wnfpt2.exe 2156 wnfpt2.exe 2484 wnfpt2.exe 2788 wnfpt2.exe 2656 wnfpt2.exe -
Processes:
resource yara_rule behavioral1/memory/2400-6-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-8-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-4-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-3-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-9-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-12-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-11-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-10-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2400-22-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2652-35-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2652-33-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2652-40-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2540-51-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2540-56-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2880-68-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2880-67-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2880-66-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2880-73-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1348-84-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1348-85-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1348-83-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1348-89-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2828-101-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2828-106-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1632-118-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1632-122-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2820-134-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2820-139-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2476-151-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2476-156-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1272-166-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1272-173-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2448-184-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2448-189-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2356-199-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2356-205-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1952-216-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1952-221-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2872-231-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2872-237-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2572-247-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2572-254-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/3008-264-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/3008-270-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1668-281-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1668-287-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1044-298-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2108-312-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1044-302-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2108-315-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2468-324-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2468-328-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1844-337-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1844-341-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1804-350-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1804-354-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2424-363-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2424-367-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2156-370-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2156-375-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2484-384-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2484-388-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2788-397-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 56 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exe1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wnfpt2.exe -
Drops file in System32 directory 56 IoCs
Processes:
wnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exe1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File opened for modification C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe File created C:\Windows\SysWOW64\wnfpt2.exe wnfpt2.exe -
Suspicious use of SetThreadContext 27 IoCs
Processes:
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exedescription pid process target process PID 2156 set thread context of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2760 set thread context of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2764 set thread context of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2824 set thread context of 2880 2824 wnfpt2.exe wnfpt2.exe PID 1164 set thread context of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1672 set thread context of 2828 1672 wnfpt2.exe wnfpt2.exe PID 316 set thread context of 1632 316 wnfpt2.exe wnfpt2.exe PID 2616 set thread context of 2820 2616 wnfpt2.exe wnfpt2.exe PID 2340 set thread context of 2476 2340 wnfpt2.exe wnfpt2.exe PID 1356 set thread context of 1272 1356 wnfpt2.exe wnfpt2.exe PID 1712 set thread context of 2448 1712 wnfpt2.exe wnfpt2.exe PID 2072 set thread context of 2356 2072 wnfpt2.exe wnfpt2.exe PID 1992 set thread context of 1952 1992 wnfpt2.exe wnfpt2.exe PID 2796 set thread context of 2872 2796 wnfpt2.exe wnfpt2.exe PID 2428 set thread context of 2572 2428 wnfpt2.exe wnfpt2.exe PID 2980 set thread context of 3008 2980 wnfpt2.exe wnfpt2.exe PID 1888 set thread context of 1668 1888 wnfpt2.exe wnfpt2.exe PID 684 set thread context of 1044 684 wnfpt2.exe wnfpt2.exe PID 596 set thread context of 2108 596 wnfpt2.exe wnfpt2.exe PID 2248 set thread context of 2468 2248 wnfpt2.exe wnfpt2.exe PID 1092 set thread context of 1844 1092 wnfpt2.exe wnfpt2.exe PID 1648 set thread context of 1804 1648 wnfpt2.exe wnfpt2.exe PID 1712 set thread context of 2424 1712 wnfpt2.exe wnfpt2.exe PID 856 set thread context of 2484 856 wnfpt2.exe wnfpt2.exe PID 1764 set thread context of 2788 1764 wnfpt2.exe wnfpt2.exe PID 2800 set thread context of 2656 2800 wnfpt2.exe wnfpt2.exe PID 2428 set thread context of 1816 2428 wnfpt2.exe wnfpt2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exepid process 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 2652 wnfpt2.exe 2540 wnfpt2.exe 2880 wnfpt2.exe 1348 wnfpt2.exe 2828 wnfpt2.exe 1632 wnfpt2.exe 2820 wnfpt2.exe 2476 wnfpt2.exe 1272 wnfpt2.exe 2448 wnfpt2.exe 2356 wnfpt2.exe 1952 wnfpt2.exe 2872 wnfpt2.exe 2572 wnfpt2.exe 3008 wnfpt2.exe 1668 wnfpt2.exe 1044 wnfpt2.exe 2108 wnfpt2.exe 2468 wnfpt2.exe 1844 wnfpt2.exe 1804 wnfpt2.exe 2424 wnfpt2.exe 2156 wnfpt2.exe 2484 wnfpt2.exe 2788 wnfpt2.exe 2656 wnfpt2.exe 1816 wnfpt2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exewnfpt2.exedescription pid process target process PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2156 wrote to memory of 2400 2156 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe PID 2400 wrote to memory of 2760 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe wnfpt2.exe PID 2400 wrote to memory of 2760 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe wnfpt2.exe PID 2400 wrote to memory of 2760 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe wnfpt2.exe PID 2400 wrote to memory of 2760 2400 1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2760 wrote to memory of 2652 2760 wnfpt2.exe wnfpt2.exe PID 2652 wrote to memory of 2764 2652 wnfpt2.exe wnfpt2.exe PID 2652 wrote to memory of 2764 2652 wnfpt2.exe wnfpt2.exe PID 2652 wrote to memory of 2764 2652 wnfpt2.exe wnfpt2.exe PID 2652 wrote to memory of 2764 2652 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2764 wrote to memory of 2540 2764 wnfpt2.exe wnfpt2.exe PID 2540 wrote to memory of 2824 2540 wnfpt2.exe wnfpt2.exe PID 2540 wrote to memory of 2824 2540 wnfpt2.exe wnfpt2.exe PID 2540 wrote to memory of 2824 2540 wnfpt2.exe wnfpt2.exe PID 2540 wrote to memory of 2824 2540 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2824 wrote to memory of 2880 2824 wnfpt2.exe wnfpt2.exe PID 2880 wrote to memory of 1164 2880 wnfpt2.exe wnfpt2.exe PID 2880 wrote to memory of 1164 2880 wnfpt2.exe wnfpt2.exe PID 2880 wrote to memory of 1164 2880 wnfpt2.exe wnfpt2.exe PID 2880 wrote to memory of 1164 2880 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1164 wrote to memory of 1348 1164 wnfpt2.exe wnfpt2.exe PID 1348 wrote to memory of 1672 1348 wnfpt2.exe wnfpt2.exe PID 1348 wrote to memory of 1672 1348 wnfpt2.exe wnfpt2.exe PID 1348 wrote to memory of 1672 1348 wnfpt2.exe wnfpt2.exe PID 1348 wrote to memory of 1672 1348 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 1672 wrote to memory of 2828 1672 wnfpt2.exe wnfpt2.exe PID 2828 wrote to memory of 316 2828 wnfpt2.exe wnfpt2.exe PID 2828 wrote to memory of 316 2828 wnfpt2.exe wnfpt2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a65f67b34573fc5611d04abacb1eb0d_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Users\Admin\AppData\Local\Temp\1A65F6~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Users\Admin\AppData\Local\Temp\1A65F6~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe47⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe54⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe57⤵
-
C:\Windows\SysWOW64\wnfpt2.exe"C:\Windows\system32\wnfpt2.exe" C:\Windows\SysWOW64\wnfpt2.exe58⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\wnfpt2.exeFilesize
129KB
MD51a65f67b34573fc5611d04abacb1eb0d
SHA14c89ea6a0342ac4a54a9940132af406ea8a5644f
SHA2564764c52d458b81c44ec06695acb16e8669ff758f3e28e7fc1488e1d79fb7fbbc
SHA512999b023ebf5c041c8e8e3129cf3cca3ea06d4e3ac8325350ec44bc523edea93ce7ea15f487d5cccf104b3bd01537be4e76510f7c2364fa4e379e11b12a60acc6
-
memory/1044-298-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1044-302-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1272-173-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1272-166-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1348-89-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1348-84-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1348-85-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1348-83-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1632-122-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1632-118-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1668-287-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1668-281-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1804-354-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1804-350-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1816-424-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1816-427-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1844-337-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1844-341-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1952-216-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1952-221-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2108-315-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2108-312-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2152-436-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2156-370-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2156-375-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2356-199-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2356-205-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-9-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-22-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-11-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-6-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-12-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-0-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-3-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-8-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-4-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2400-10-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2424-363-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2424-367-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2448-189-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2448-184-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2468-324-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2468-328-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2476-156-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2476-151-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2484-388-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2484-384-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2540-51-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2540-56-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2572-247-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2572-254-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2652-35-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2652-34-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2652-33-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2652-40-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2656-414-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2656-411-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2788-397-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2788-401-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2820-134-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2820-139-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2828-106-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2828-101-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2872-237-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2872-231-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2880-68-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2880-67-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2880-66-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2880-73-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3008-264-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3008-270-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB