Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 01:00
Static task
static1
Behavioral task
behavioral1
Sample
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe
-
Size
151KB
-
MD5
1d3209d60e33ec86ddcf0cd569132c99
-
SHA1
699b70b9d1b5f6cfed21f9cc3e3361f8f00a2292
-
SHA256
c82e1dde36a2a75cbc86b475f072ecff05f77fd874c89d059c85836ff539fd06
-
SHA512
1f393be5025d829bf4404453ecec1823749dd06d3380ea400d564a38cb291f6b2c70326f3c44d9813c4c0aa9315a018438844983c36555e6585586b1a757537b
-
SSDEEP
3072:XpTRBSXcKETiLb1PnX+3xDmm+jV5JiOxFBWESCGRtexmqQY9:XpeXcKEwZPX+3xqmCVbisEEwRw3
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exe1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation wmpcfg32.exe -
Deletes itself 1 IoCs
Processes:
wmpcfg32.exepid process 2024 wmpcfg32.exe -
Executes dropped EXE 28 IoCs
Processes:
wmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exepid process 3944 wmpcfg32.exe 2024 wmpcfg32.exe 1440 wmpcfg32.exe 2352 wmpcfg32.exe 4892 wmpcfg32.exe 3128 wmpcfg32.exe 2968 wmpcfg32.exe 3048 wmpcfg32.exe 2100 wmpcfg32.exe 3620 wmpcfg32.exe 3632 wmpcfg32.exe 4396 wmpcfg32.exe 2892 wmpcfg32.exe 2668 wmpcfg32.exe 2004 wmpcfg32.exe 1040 wmpcfg32.exe 468 wmpcfg32.exe 1680 wmpcfg32.exe 4336 wmpcfg32.exe 776 wmpcfg32.exe 948 wmpcfg32.exe 392 wmpcfg32.exe 2656 wmpcfg32.exe 4064 wmpcfg32.exe 4260 wmpcfg32.exe 1156 wmpcfg32.exe 3868 wmpcfg32.exe 4520 wmpcfg32.exe -
Processes:
resource yara_rule behavioral2/memory/3148-0-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3148-3-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3148-5-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3148-4-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3148-41-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2024-45-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2024-46-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2024-47-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2024-51-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2352-59-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3128-64-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3128-69-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3048-77-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3620-82-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3620-86-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4396-94-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2668-99-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2668-103-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1040-108-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1040-110-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1680-116-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1680-115-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1680-114-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1680-120-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/776-128-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/392-133-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/392-137-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/4064-145-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1156-149-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/1156-154-0x0000000000400000-0x0000000000455000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exe1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpcfg32.exe -
Drops file in System32 directory 42 IoCs
Processes:
wmpcfg32.exewmpcfg32.exe1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\ wmpcfg32.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe File created C:\Windows\SysWOW64\wmpcfg32.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpcfg32.exe wmpcfg32.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription pid process target process PID 3296 set thread context of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3944 set thread context of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 1440 set thread context of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 4892 set thread context of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 2968 set thread context of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2100 set thread context of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 3632 set thread context of 4396 3632 wmpcfg32.exe wmpcfg32.exe PID 2892 set thread context of 2668 2892 wmpcfg32.exe wmpcfg32.exe PID 2004 set thread context of 1040 2004 wmpcfg32.exe wmpcfg32.exe PID 468 set thread context of 1680 468 wmpcfg32.exe wmpcfg32.exe PID 4336 set thread context of 776 4336 wmpcfg32.exe wmpcfg32.exe PID 948 set thread context of 392 948 wmpcfg32.exe wmpcfg32.exe PID 2656 set thread context of 4064 2656 wmpcfg32.exe wmpcfg32.exe PID 4260 set thread context of 1156 4260 wmpcfg32.exe wmpcfg32.exe PID 3868 set thread context of 4520 3868 wmpcfg32.exe wmpcfg32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 14 IoCs
Processes:
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpcfg32.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exepid process 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 2024 wmpcfg32.exe 2024 wmpcfg32.exe 2024 wmpcfg32.exe 2024 wmpcfg32.exe 2352 wmpcfg32.exe 2352 wmpcfg32.exe 2352 wmpcfg32.exe 2352 wmpcfg32.exe 3128 wmpcfg32.exe 3128 wmpcfg32.exe 3128 wmpcfg32.exe 3128 wmpcfg32.exe 3048 wmpcfg32.exe 3048 wmpcfg32.exe 3048 wmpcfg32.exe 3048 wmpcfg32.exe 3620 wmpcfg32.exe 3620 wmpcfg32.exe 3620 wmpcfg32.exe 3620 wmpcfg32.exe 4396 wmpcfg32.exe 4396 wmpcfg32.exe 4396 wmpcfg32.exe 4396 wmpcfg32.exe 2668 wmpcfg32.exe 2668 wmpcfg32.exe 2668 wmpcfg32.exe 2668 wmpcfg32.exe 1040 wmpcfg32.exe 1040 wmpcfg32.exe 1040 wmpcfg32.exe 1040 wmpcfg32.exe 1680 wmpcfg32.exe 1680 wmpcfg32.exe 1680 wmpcfg32.exe 1680 wmpcfg32.exe 776 wmpcfg32.exe 776 wmpcfg32.exe 776 wmpcfg32.exe 776 wmpcfg32.exe 392 wmpcfg32.exe 392 wmpcfg32.exe 392 wmpcfg32.exe 392 wmpcfg32.exe 4064 wmpcfg32.exe 4064 wmpcfg32.exe 4064 wmpcfg32.exe 4064 wmpcfg32.exe 1156 wmpcfg32.exe 1156 wmpcfg32.exe 1156 wmpcfg32.exe 1156 wmpcfg32.exe 4520 wmpcfg32.exe 4520 wmpcfg32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exewmpcfg32.exedescription pid process target process PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3296 wrote to memory of 3148 3296 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe PID 3148 wrote to memory of 3944 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe wmpcfg32.exe PID 3148 wrote to memory of 3944 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe wmpcfg32.exe PID 3148 wrote to memory of 3944 3148 1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 3944 wrote to memory of 2024 3944 wmpcfg32.exe wmpcfg32.exe PID 2024 wrote to memory of 1440 2024 wmpcfg32.exe wmpcfg32.exe PID 2024 wrote to memory of 1440 2024 wmpcfg32.exe wmpcfg32.exe PID 2024 wrote to memory of 1440 2024 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 1440 wrote to memory of 2352 1440 wmpcfg32.exe wmpcfg32.exe PID 2352 wrote to memory of 4892 2352 wmpcfg32.exe wmpcfg32.exe PID 2352 wrote to memory of 4892 2352 wmpcfg32.exe wmpcfg32.exe PID 2352 wrote to memory of 4892 2352 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 4892 wrote to memory of 3128 4892 wmpcfg32.exe wmpcfg32.exe PID 3128 wrote to memory of 2968 3128 wmpcfg32.exe wmpcfg32.exe PID 3128 wrote to memory of 2968 3128 wmpcfg32.exe wmpcfg32.exe PID 3128 wrote to memory of 2968 3128 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 2968 wrote to memory of 3048 2968 wmpcfg32.exe wmpcfg32.exe PID 3048 wrote to memory of 2100 3048 wmpcfg32.exe wmpcfg32.exe PID 3048 wrote to memory of 2100 3048 wmpcfg32.exe wmpcfg32.exe PID 3048 wrote to memory of 2100 3048 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 2100 wrote to memory of 3620 2100 wmpcfg32.exe wmpcfg32.exe PID 3620 wrote to memory of 3632 3620 wmpcfg32.exe wmpcfg32.exe PID 3620 wrote to memory of 3632 3620 wmpcfg32.exe wmpcfg32.exe PID 3620 wrote to memory of 3632 3620 wmpcfg32.exe wmpcfg32.exe PID 3632 wrote to memory of 4396 3632 wmpcfg32.exe wmpcfg32.exe PID 3632 wrote to memory of 4396 3632 wmpcfg32.exe wmpcfg32.exe PID 3632 wrote to memory of 4396 3632 wmpcfg32.exe wmpcfg32.exe PID 3632 wrote to memory of 4396 3632 wmpcfg32.exe wmpcfg32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1d3209d60e33ec86ddcf0cd569132c99_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Users\Admin\AppData\Local\Temp\1D3209~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Users\Admin\AppData\Local\Temp\1D3209~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpcfg32.exe"C:\Windows\system32\wmpcfg32.exe" C:\Windows\SysWOW64\wmpcfg32.exe30⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpcfg32.exeFilesize
151KB
MD51d3209d60e33ec86ddcf0cd569132c99
SHA1699b70b9d1b5f6cfed21f9cc3e3361f8f00a2292
SHA256c82e1dde36a2a75cbc86b475f072ecff05f77fd874c89d059c85836ff539fd06
SHA5121f393be5025d829bf4404453ecec1823749dd06d3380ea400d564a38cb291f6b2c70326f3c44d9813c4c0aa9315a018438844983c36555e6585586b1a757537b
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/392-133-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/392-137-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/776-128-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1040-108-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1040-110-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1156-149-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1156-154-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1680-120-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1680-114-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1680-115-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/1680-116-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2024-47-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2024-51-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2024-45-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2024-46-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2352-59-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2668-99-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2668-103-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3048-77-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3128-69-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3128-64-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3148-0-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3148-41-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3148-4-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3148-5-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3148-3-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3620-86-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/3620-82-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4064-145-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4396-94-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB