Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
01-07-2024 10:22
General
-
Target
1aeda6ec35f1076db6b88da73f670640_JaffaCakes118.exe
-
Size
160KB
-
MD5
1aeda6ec35f1076db6b88da73f670640
-
SHA1
8c77c2a2ed7e7d800b266fb09c03d913e863771d
-
SHA256
226d19ed695c9b68d08266d31b7260129846f8c24096b6b6f52d6f3a47e5203a
-
SHA512
17c2a05cf4e8f0616c5e31d1b41c083b95583510962a4c08c0743656f0d69e9a8886f9dc3eadc1314b323db6dc82fe9cf5b2cb0c41876efcf11e941a80231fa0
-
SSDEEP
3072:uv/1tNNdyaiRScHtelmKjXgMmMSRwA0zhL4cLMw5YQHGgUpJLxM5:uvvd2Nh8XgMmNczTMAY0kpZE
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 59 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 59 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aeda6ec35f1076db6b88da73f670640_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1aeda6ec35f1076db6b88da73f670640_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1aeda6ec35f1076db6b88da73f670640_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1aeda6ec35f1076db6b88da73f670640_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Users\Admin\AppData\Local\Temp\1AEDA6~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Users\Admin\AppData\Local\Temp\1AEDA6~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe54⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe56⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe58⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe60⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe62⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe64⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe66⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe67⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe68⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe69⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe70⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe71⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe72⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe73⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe74⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe75⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe76⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe77⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe78⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe79⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe80⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe81⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe82⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe83⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe84⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe85⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe86⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe87⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe88⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe89⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe90⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe91⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe92⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe93⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe94⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe95⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe96⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe97⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe98⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe99⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe100⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe101⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe102⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe103⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe104⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe105⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe106⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe107⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe108⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe109⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe110⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe111⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe112⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe113⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe114⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe115⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe116⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe117⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wnplt4.exe"C:\Windows\system32\wnplt4.exe" C:\Windows\SysWOW64\wnplt4.exe118⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\wnplt4.exeFilesize
160KB
MD51aeda6ec35f1076db6b88da73f670640
SHA18c77c2a2ed7e7d800b266fb09c03d913e863771d
SHA256226d19ed695c9b68d08266d31b7260129846f8c24096b6b6f52d6f3a47e5203a
SHA51217c2a05cf4e8f0616c5e31d1b41c083b95583510962a4c08c0743656f0d69e9a8886f9dc3eadc1314b323db6dc82fe9cf5b2cb0c41876efcf11e941a80231fa0
-
memory/336-647-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/336-650-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/544-273-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/544-270-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/568-121-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/568-126-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/628-390-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/628-387-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/692-403-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/692-400-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/844-533-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/844-529-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/852-491-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/852-494-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1044-103-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1044-109-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1056-296-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1056-299-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1064-559-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1064-556-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1104-230-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1104-224-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1176-689-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1176-686-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1308-624-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1308-621-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1468-283-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1468-286-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1544-138-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1544-143-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1580-172-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1580-178-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1600-325-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1600-322-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1724-155-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1724-160-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1728-663-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1728-660-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1856-426-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1856-429-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1908-351-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/1908-348-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2052-416-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2052-413-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2100-676-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2100-672-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2184-637-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2184-634-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2244-520-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2244-517-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2268-92-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2268-86-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2272-572-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2272-569-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2344-260-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2344-257-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2348-608-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2348-611-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2392-543-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2392-546-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2464-207-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2464-213-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2520-481-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2520-478-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2540-439-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2540-442-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2560-68-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2560-75-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2576-465-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2576-468-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2592-452-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2592-455-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2628-364-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2628-360-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2640-595-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2640-598-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2648-195-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2648-188-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2780-338-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2780-335-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2792-33-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2792-34-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2792-32-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2792-40-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2800-374-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2800-377-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2832-247-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2832-241-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2888-309-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2888-312-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2948-51-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2948-57-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2948-50-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2948-49-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2988-585-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2988-582-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-2-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-22-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-3-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-0-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-4-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-6-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-7-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-9-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3024-8-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3064-504-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/3064-507-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB