Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 21:05
Behavioral task
behavioral1
Sample
4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe
-
Size
23KB
-
MD5
4b64781c434dc876d32cc1d78b033f35
-
SHA1
df7adef993d730748170af0e22070d4a8d23a77c
-
SHA256
fbfb56a6d1b56e63a4b5e4f70081a313c3056a9e27ba9da9c058eb86b9d984a0
-
SHA512
767ddf5b505c4ae1d64cabe4358913b2fed70b740f2ddf76bea53990a0632e16405d120709ccbb79dc0a0992cd596e196178bbde956844265d34ec62e5271e07
-
SSDEEP
384:WwznVKyqCvPSryiZuLwhiy8ysvW8bTLRmUmygy:WQnwfCy2whHsvLbT5F
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2148 oibvzp.exe 2724 pfbedgs.exe 2652 dmtwacqi.exe 2744 wzvwyx.exe 2672 xomhml.exe 2548 vsvuo.exe 2204 cfgzqn.exe 2844 ixgfig.exe 2124 jmjpwcn.exe 1752 ifjiber.exe 2408 nyqpbwa.exe 1904 ibiuquue.exe 2812 narkuco.exe 1736 wsylu.exe 1156 aollyxh.exe 2212 lsadkd.exe 1080 zejymrs.exe 2328 ofgburxq.exe 2284 xndeqy.exe 1064 zjhmz.exe 1108 ojqdr.exe 944 zuwzrjq.exe 2404 jyyxsvxd.exe 860 wjakzhgq.exe 2144 jztyly.exe 1716 ciyvzhi.exe 2384 auxpjezl.exe 2416 htcvax.exe 2092 emwvndg.exe 1488 llaanpsk.exe 1760 nhevmv.exe 2016 bpcff.exe 1704 daxuj.exe 2616 trimqx.exe 2636 wfarvadb.exe 2512 xwgerzr.exe 2948 jkehi.exe 2644 jjovoenc.exe 2240 kshcyppi.exe 2704 bzldz.exe 2964 ykhcsnny.exe 2976 lehhg.exe 2936 yfmos.exe 2544 kyoifr.exe 1492 unahdrz.exe 1600 vxugl.exe 976 xypyjty.exe 2684 xvxtn.exe 1548 fxyqh.exe 2824 frfdkorz.exe 1940 fylgvz.exe 1060 kpkgyv.exe 2076 ilgwmsz.exe 1364 ttqoxxc.exe 2140 baaqgjau.exe 1912 ycalkfoo.exe 828 znknvz.exe 1164 drlbmgj.exe 1676 bmijaqdk.exe 3016 ypfulqzj.exe 1072 wxmcqqi.exe 2864 hywqdnhf.exe 2804 ddgusou.exe 1592 yatmg.exe -
Loads dropped DLL 64 IoCs
pid Process 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 2148 oibvzp.exe 2148 oibvzp.exe 2724 pfbedgs.exe 2724 pfbedgs.exe 2652 dmtwacqi.exe 2652 dmtwacqi.exe 2744 wzvwyx.exe 2744 wzvwyx.exe 2672 xomhml.exe 2672 xomhml.exe 2548 vsvuo.exe 2548 vsvuo.exe 2204 cfgzqn.exe 2204 cfgzqn.exe 2844 ixgfig.exe 2844 ixgfig.exe 2124 jmjpwcn.exe 2124 jmjpwcn.exe 1752 ifjiber.exe 1752 ifjiber.exe 2408 nyqpbwa.exe 2408 nyqpbwa.exe 1904 ibiuquue.exe 1904 ibiuquue.exe 2812 narkuco.exe 2812 narkuco.exe 1736 wsylu.exe 1736 wsylu.exe 1156 aollyxh.exe 1156 aollyxh.exe 2212 lsadkd.exe 2212 lsadkd.exe 1080 zejymrs.exe 1080 zejymrs.exe 2328 ofgburxq.exe 2328 ofgburxq.exe 2284 xndeqy.exe 2284 xndeqy.exe 1064 zjhmz.exe 1064 zjhmz.exe 1108 ojqdr.exe 1108 ojqdr.exe 944 zuwzrjq.exe 944 zuwzrjq.exe 2404 jyyxsvxd.exe 2404 jyyxsvxd.exe 860 wjakzhgq.exe 860 wjakzhgq.exe 2144 jztyly.exe 2144 jztyly.exe 1716 ciyvzhi.exe 1716 ciyvzhi.exe 2384 auxpjezl.exe 2384 auxpjezl.exe 2416 htcvax.exe 2416 htcvax.exe 2092 emwvndg.exe 2092 emwvndg.exe 1488 llaanpsk.exe 1488 llaanpsk.exe 1760 nhevmv.exe 1760 nhevmv.exe -
resource yara_rule behavioral1/memory/1988-0-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/files/0x000e000000016859-7.dat upx behavioral1/memory/2148-10-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2724-20-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2652-39-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/2652-38-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/2672-54-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2844-85-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/1752-104-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/1752-113-0x0000000000270000-0x0000000000280000-memory.dmp upx behavioral1/memory/1156-163-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/1156-209-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/2544-315-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/3616-793-0x0000000031420000-0x0000000031430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xsxga.exe" fcitdql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ihwhvyxl.exe" aljvyn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mrrrwtul.exe" xqrzp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mfwzyu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\aexzomj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\aygrrny.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yotsjud.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jhvhbwv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\pzyygj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tgmrl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vdkfqn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hulfz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bdhslpj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nbcrly.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ucksnsqy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xsnvoe.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dbqtt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fntpavn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fexgqo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ordmnr.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wmzesphd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rbgeqft.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nthylept.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tljtca.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\gltjfi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\btycg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ttzmowss.exe" gycuykje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tplxe.exe" vvequ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jaqxm.exe" ufiqmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dbcch.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cdiiod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wkagfbcw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bqucibu.exe" ssholtis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lrpmg.exe" jodasnot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rcxqf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xwfniht.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uxyhi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\viaas.exe" tccfvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tclxpu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xcgcfq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qtdfeje.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fbjeqgt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uirizpb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vaityof.exe" gnqikwyo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qultk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tlhfqm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\etsqigy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ydmjc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ugqxvgi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oedvjmh.exe" nhnxcar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\krntd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cephp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\waqhhmdd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ojnef.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\duvgy.exe" bdkqw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ybqczamk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jvzirzva.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tukkbya.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bbztj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\avntbu.exe" ijdgrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fiirz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lweppdil.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sywfw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zrekschk.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\pyhsoz.exe Process not Found File created C:\Windows\SysWOW64\xqgqohrj.exe Process not Found File opened for modification C:\Windows\SysWOW64\hpwbxx.exe Process not Found File created C:\Windows\SysWOW64\gflkq.exe Process not Found File opened for modification C:\Windows\SysWOW64\wqducwwy.exe Process not Found File created C:\Windows\SysWOW64\grxqhi.exe Process not Found File opened for modification C:\Windows\SysWOW64\stdwgkw.exe Process not Found File created C:\Windows\SysWOW64\vlzlrlas.exe Process not Found File created C:\Windows\SysWOW64\hwdbt.exe Process not Found File created C:\Windows\SysWOW64\oolmfku.exe Process not Found File created C:\Windows\SysWOW64\hpubms.exe Process not Found File created C:\Windows\SysWOW64\glvijj.exe Process not Found File created C:\Windows\SysWOW64\ujdole.exe Process not Found File created C:\Windows\SysWOW64\qrsjej.exe Process not Found File opened for modification C:\Windows\SysWOW64\xajrq.exe Process not Found File opened for modification C:\Windows\SysWOW64\kcnhrzsu.exe Process not Found File created C:\Windows\SysWOW64\rjhkwq.exe Process not Found File opened for modification C:\Windows\SysWOW64\tzhpcppg.exe Process not Found File created C:\Windows\SysWOW64\ukoem.exe Process not Found File created C:\Windows\SysWOW64\yolvu.exe Process not Found File created C:\Windows\SysWOW64\bavmnnh.exe Process not Found File opened for modification C:\Windows\SysWOW64\shmlgxd.exe Process not Found File opened for modification C:\Windows\SysWOW64\yuuhgn.exe Process not Found File created C:\Windows\SysWOW64\bajzq.exe yxreyoow.exe File created C:\Windows\SysWOW64\qmodked.exe csdtgcxq.exe File created C:\Windows\SysWOW64\piiol.exe Process not Found File created C:\Windows\SysWOW64\pmycv.exe Process not Found File opened for modification C:\Windows\SysWOW64\lmxllg.exe Process not Found File created C:\Windows\SysWOW64\mthjxec.exe zgzgqmj.exe File created C:\Windows\SysWOW64\ldedd.exe mrhawpn.exe File created C:\Windows\SysWOW64\dxpblobh.exe ciojvoyx.exe File created C:\Windows\SysWOW64\fokzxysd.exe Process not Found File created C:\Windows\SysWOW64\iplnc.exe Process not Found File opened for modification C:\Windows\SysWOW64\xtogv.exe ldvnuf.exe File created C:\Windows\SysWOW64\dwveuxo.exe Process not Found File created C:\Windows\SysWOW64\gunmpw.exe Process not Found File created C:\Windows\SysWOW64\frmhimi.exe oxbqxhgs.exe File created C:\Windows\SysWOW64\qledyz.exe Process not Found File created C:\Windows\SysWOW64\fbozuggt.exe Process not Found File opened for modification C:\Windows\SysWOW64\inupj.exe Process not Found File created C:\Windows\SysWOW64\gjgpming.exe Process not Found File opened for modification C:\Windows\SysWOW64\jduuvokf.exe xknjh.exe File opened for modification C:\Windows\SysWOW64\jcqwrq.exe Process not Found File created C:\Windows\SysWOW64\chusy.exe Process not Found File opened for modification C:\Windows\SysWOW64\xpcwlp.exe Process not Found File opened for modification C:\Windows\SysWOW64\oqakfk.exe Process not Found File created C:\Windows\SysWOW64\dlido.exe Process not Found File created C:\Windows\SysWOW64\caphkxg.exe Process not Found File opened for modification C:\Windows\SysWOW64\xlliyk.exe Process not Found File opened for modification C:\Windows\SysWOW64\lvudxeus.exe Process not Found File opened for modification C:\Windows\SysWOW64\vwqkvyvy.exe Process not Found File created C:\Windows\SysWOW64\leiwpm.exe Process not Found File created C:\Windows\SysWOW64\ovqkn.exe Process not Found File opened for modification C:\Windows\SysWOW64\aadsil.exe Process not Found File created C:\Windows\SysWOW64\csnxt.exe dyxfnsax.exe File created C:\Windows\SysWOW64\juelszst.exe Process not Found File opened for modification C:\Windows\SysWOW64\ugzllm.exe Process not Found File opened for modification C:\Windows\SysWOW64\qozylbqo.exe Process not Found File created C:\Windows\SysWOW64\jaaggjcn.exe Process not Found File opened for modification C:\Windows\SysWOW64\bjtdlqg.exe Process not Found File opened for modification C:\Windows\SysWOW64\nlwbdc.exe Process not Found File opened for modification C:\Windows\SysWOW64\xypyjty.exe vxugl.exe File created C:\Windows\SysWOW64\uuvtvj.exe Process not Found File created C:\Windows\SysWOW64\zmgxsqb.exe Process not Found -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe Token: SeDebugPrivilege 2148 oibvzp.exe Token: SeDebugPrivilege 2724 pfbedgs.exe Token: SeDebugPrivilege 2652 dmtwacqi.exe Token: SeDebugPrivilege 2744 wzvwyx.exe Token: SeDebugPrivilege 2672 xomhml.exe Token: SeDebugPrivilege 2548 vsvuo.exe Token: SeDebugPrivilege 2204 cfgzqn.exe Token: SeDebugPrivilege 2844 ixgfig.exe Token: SeDebugPrivilege 2124 jmjpwcn.exe Token: SeDebugPrivilege 1752 ifjiber.exe Token: SeDebugPrivilege 2408 nyqpbwa.exe Token: SeDebugPrivilege 1904 ibiuquue.exe Token: SeDebugPrivilege 2812 narkuco.exe Token: SeDebugPrivilege 1736 wsylu.exe Token: SeDebugPrivilege 1156 aollyxh.exe Token: SeDebugPrivilege 2212 lsadkd.exe Token: SeDebugPrivilege 1080 zejymrs.exe Token: SeDebugPrivilege 2328 ofgburxq.exe Token: SeDebugPrivilege 2284 xndeqy.exe Token: SeDebugPrivilege 1064 zjhmz.exe Token: SeDebugPrivilege 1108 ojqdr.exe Token: SeDebugPrivilege 944 zuwzrjq.exe Token: SeDebugPrivilege 2404 jyyxsvxd.exe Token: SeDebugPrivilege 860 wjakzhgq.exe Token: SeDebugPrivilege 2144 jztyly.exe Token: SeDebugPrivilege 1716 ciyvzhi.exe Token: SeDebugPrivilege 2384 auxpjezl.exe Token: SeDebugPrivilege 2416 htcvax.exe Token: SeDebugPrivilege 2092 emwvndg.exe Token: SeDebugPrivilege 1488 llaanpsk.exe Token: SeDebugPrivilege 1760 nhevmv.exe Token: SeDebugPrivilege 2016 bpcff.exe Token: SeDebugPrivilege 1704 daxuj.exe Token: SeDebugPrivilege 2616 trimqx.exe Token: SeDebugPrivilege 2636 wfarvadb.exe Token: SeDebugPrivilege 2512 xwgerzr.exe Token: SeDebugPrivilege 2948 jkehi.exe Token: SeDebugPrivilege 2644 jjovoenc.exe Token: SeDebugPrivilege 2240 kshcyppi.exe Token: SeDebugPrivilege 2704 bzldz.exe Token: SeDebugPrivilege 2964 ykhcsnny.exe Token: SeDebugPrivilege 2976 lehhg.exe Token: SeDebugPrivilege 2936 yfmos.exe Token: SeDebugPrivilege 2544 kyoifr.exe Token: SeDebugPrivilege 1492 unahdrz.exe Token: SeDebugPrivilege 1600 vxugl.exe Token: SeDebugPrivilege 976 xypyjty.exe Token: SeDebugPrivilege 2684 xvxtn.exe Token: SeDebugPrivilege 1548 fxyqh.exe Token: SeDebugPrivilege 2824 frfdkorz.exe Token: SeDebugPrivilege 1940 fylgvz.exe Token: SeDebugPrivilege 1060 kpkgyv.exe Token: SeDebugPrivilege 2076 ilgwmsz.exe Token: SeDebugPrivilege 1364 ttqoxxc.exe Token: SeDebugPrivilege 2140 baaqgjau.exe Token: SeDebugPrivilege 1912 ycalkfoo.exe Token: SeDebugPrivilege 828 znknvz.exe Token: SeDebugPrivilege 1164 drlbmgj.exe Token: SeDebugPrivilege 1676 bmijaqdk.exe Token: SeDebugPrivilege 3016 ypfulqzj.exe Token: SeDebugPrivilege 1072 wxmcqqi.exe Token: SeDebugPrivilege 2864 hywqdnhf.exe Token: SeDebugPrivilege 2804 ddgusou.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2148 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 30 PID 1988 wrote to memory of 2148 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 30 PID 1988 wrote to memory of 2148 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 30 PID 1988 wrote to memory of 2148 1988 4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe 30 PID 2148 wrote to memory of 2724 2148 oibvzp.exe 31 PID 2148 wrote to memory of 2724 2148 oibvzp.exe 31 PID 2148 wrote to memory of 2724 2148 oibvzp.exe 31 PID 2148 wrote to memory of 2724 2148 oibvzp.exe 31 PID 2724 wrote to memory of 2652 2724 pfbedgs.exe 32 PID 2724 wrote to memory of 2652 2724 pfbedgs.exe 32 PID 2724 wrote to memory of 2652 2724 pfbedgs.exe 32 PID 2724 wrote to memory of 2652 2724 pfbedgs.exe 32 PID 2652 wrote to memory of 2744 2652 dmtwacqi.exe 33 PID 2652 wrote to memory of 2744 2652 dmtwacqi.exe 33 PID 2652 wrote to memory of 2744 2652 dmtwacqi.exe 33 PID 2652 wrote to memory of 2744 2652 dmtwacqi.exe 33 PID 2744 wrote to memory of 2672 2744 wzvwyx.exe 34 PID 2744 wrote to memory of 2672 2744 wzvwyx.exe 34 PID 2744 wrote to memory of 2672 2744 wzvwyx.exe 34 PID 2744 wrote to memory of 2672 2744 wzvwyx.exe 34 PID 2672 wrote to memory of 2548 2672 xomhml.exe 35 PID 2672 wrote to memory of 2548 2672 xomhml.exe 35 PID 2672 wrote to memory of 2548 2672 xomhml.exe 35 PID 2672 wrote to memory of 2548 2672 xomhml.exe 35 PID 2548 wrote to memory of 2204 2548 vsvuo.exe 36 PID 2548 wrote to memory of 2204 2548 vsvuo.exe 36 PID 2548 wrote to memory of 2204 2548 vsvuo.exe 36 PID 2548 wrote to memory of 2204 2548 vsvuo.exe 36 PID 2204 wrote to memory of 2844 2204 cfgzqn.exe 37 PID 2204 wrote to memory of 2844 2204 cfgzqn.exe 37 PID 2204 wrote to memory of 2844 2204 cfgzqn.exe 37 PID 2204 wrote to memory of 2844 2204 cfgzqn.exe 37 PID 2844 wrote to memory of 2124 2844 ixgfig.exe 38 PID 2844 wrote to memory of 2124 2844 ixgfig.exe 38 PID 2844 wrote to memory of 2124 2844 ixgfig.exe 38 PID 2844 wrote to memory of 2124 2844 ixgfig.exe 38 PID 2124 wrote to memory of 1752 2124 jmjpwcn.exe 39 PID 2124 wrote to memory of 1752 2124 jmjpwcn.exe 39 PID 2124 wrote to memory of 1752 2124 jmjpwcn.exe 39 PID 2124 wrote to memory of 1752 2124 jmjpwcn.exe 39 PID 1752 wrote to memory of 2408 1752 ifjiber.exe 40 PID 1752 wrote to memory of 2408 1752 ifjiber.exe 40 PID 1752 wrote to memory of 2408 1752 ifjiber.exe 40 PID 1752 wrote to memory of 2408 1752 ifjiber.exe 40 PID 2408 wrote to memory of 1904 2408 nyqpbwa.exe 41 PID 2408 wrote to memory of 1904 2408 nyqpbwa.exe 41 PID 2408 wrote to memory of 1904 2408 nyqpbwa.exe 41 PID 2408 wrote to memory of 1904 2408 nyqpbwa.exe 41 PID 1904 wrote to memory of 2812 1904 ibiuquue.exe 42 PID 1904 wrote to memory of 2812 1904 ibiuquue.exe 42 PID 1904 wrote to memory of 2812 1904 ibiuquue.exe 42 PID 1904 wrote to memory of 2812 1904 ibiuquue.exe 42 PID 2812 wrote to memory of 1736 2812 narkuco.exe 43 PID 2812 wrote to memory of 1736 2812 narkuco.exe 43 PID 2812 wrote to memory of 1736 2812 narkuco.exe 43 PID 2812 wrote to memory of 1736 2812 narkuco.exe 43 PID 1736 wrote to memory of 1156 1736 wsylu.exe 44 PID 1736 wrote to memory of 1156 1736 wsylu.exe 44 PID 1736 wrote to memory of 1156 1736 wsylu.exe 44 PID 1736 wrote to memory of 1156 1736 wsylu.exe 44 PID 1156 wrote to memory of 2212 1156 aollyxh.exe 45 PID 1156 wrote to memory of 2212 1156 aollyxh.exe 45 PID 1156 wrote to memory of 2212 1156 aollyxh.exe 45 PID 1156 wrote to memory of 2212 1156 aollyxh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b64781c434dc876d32cc1d78b033f35_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\oibvzp.exeC:\Windows\system32\oibvzp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\pfbedgs.exeC:\Windows\system32\pfbedgs.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\dmtwacqi.exeC:\Windows\system32\dmtwacqi.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\wzvwyx.exeC:\Windows\system32\wzvwyx.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\xomhml.exeC:\Windows\system32\xomhml.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\vsvuo.exeC:\Windows\system32\vsvuo.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cfgzqn.exeC:\Windows\system32\cfgzqn.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\ixgfig.exeC:\Windows\system32\ixgfig.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\jmjpwcn.exeC:\Windows\system32\jmjpwcn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\ifjiber.exeC:\Windows\system32\ifjiber.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\nyqpbwa.exeC:\Windows\system32\nyqpbwa.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\ibiuquue.exeC:\Windows\system32\ibiuquue.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\narkuco.exeC:\Windows\system32\narkuco.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\wsylu.exeC:\Windows\system32\wsylu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\aollyxh.exeC:\Windows\system32\aollyxh.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\lsadkd.exeC:\Windows\system32\lsadkd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\SysWOW64\zejymrs.exeC:\Windows\system32\zejymrs.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1080 -
C:\Windows\SysWOW64\ofgburxq.exeC:\Windows\system32\ofgburxq.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Windows\SysWOW64\xndeqy.exeC:\Windows\system32\xndeqy.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\SysWOW64\zjhmz.exeC:\Windows\system32\zjhmz.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\ojqdr.exeC:\Windows\system32\ojqdr.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\SysWOW64\zuwzrjq.exeC:\Windows\system32\zuwzrjq.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:944 -
C:\Windows\SysWOW64\jyyxsvxd.exeC:\Windows\system32\jyyxsvxd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\SysWOW64\wjakzhgq.exeC:\Windows\system32\wjakzhgq.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\jztyly.exeC:\Windows\system32\jztyly.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Windows\SysWOW64\ciyvzhi.exeC:\Windows\system32\ciyvzhi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\SysWOW64\auxpjezl.exeC:\Windows\system32\auxpjezl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\SysWOW64\htcvax.exeC:\Windows\system32\htcvax.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Windows\SysWOW64\emwvndg.exeC:\Windows\system32\emwvndg.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\SysWOW64\llaanpsk.exeC:\Windows\system32\llaanpsk.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Windows\SysWOW64\nhevmv.exeC:\Windows\system32\nhevmv.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\SysWOW64\bpcff.exeC:\Windows\system32\bpcff.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\SysWOW64\daxuj.exeC:\Windows\system32\daxuj.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1704 -
C:\Windows\SysWOW64\trimqx.exeC:\Windows\system32\trimqx.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Windows\SysWOW64\wfarvadb.exeC:\Windows\system32\wfarvadb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Windows\SysWOW64\xwgerzr.exeC:\Windows\system32\xwgerzr.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512 -
C:\Windows\SysWOW64\jkehi.exeC:\Windows\system32\jkehi.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Windows\SysWOW64\jjovoenc.exeC:\Windows\system32\jjovoenc.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644 -
C:\Windows\SysWOW64\kshcyppi.exeC:\Windows\system32\kshcyppi.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\bzldz.exeC:\Windows\system32\bzldz.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\SysWOW64\ykhcsnny.exeC:\Windows\system32\ykhcsnny.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Windows\SysWOW64\lehhg.exeC:\Windows\system32\lehhg.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Windows\SysWOW64\yfmos.exeC:\Windows\system32\yfmos.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\SysWOW64\kyoifr.exeC:\Windows\system32\kyoifr.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\unahdrz.exeC:\Windows\system32\unahdrz.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492 -
C:\Windows\SysWOW64\vxugl.exeC:\Windows\system32\vxugl.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\xypyjty.exeC:\Windows\system32\xypyjty.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:976 -
C:\Windows\SysWOW64\xvxtn.exeC:\Windows\system32\xvxtn.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Windows\SysWOW64\fxyqh.exeC:\Windows\system32\fxyqh.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\SysWOW64\frfdkorz.exeC:\Windows\system32\frfdkorz.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Windows\SysWOW64\fylgvz.exeC:\Windows\system32\fylgvz.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\SysWOW64\kpkgyv.exeC:\Windows\system32\kpkgyv.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060 -
C:\Windows\SysWOW64\ilgwmsz.exeC:\Windows\system32\ilgwmsz.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\SysWOW64\ttqoxxc.exeC:\Windows\system32\ttqoxxc.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Windows\SysWOW64\baaqgjau.exeC:\Windows\system32\baaqgjau.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Windows\SysWOW64\ycalkfoo.exeC:\Windows\system32\ycalkfoo.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912 -
C:\Windows\SysWOW64\znknvz.exeC:\Windows\system32\znknvz.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:828 -
C:\Windows\SysWOW64\drlbmgj.exeC:\Windows\system32\drlbmgj.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Windows\SysWOW64\bmijaqdk.exeC:\Windows\system32\bmijaqdk.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\ypfulqzj.exeC:\Windows\system32\ypfulqzj.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\wxmcqqi.exeC:\Windows\system32\wxmcqqi.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\SysWOW64\hywqdnhf.exeC:\Windows\system32\hywqdnhf.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\SysWOW64\ddgusou.exeC:\Windows\system32\ddgusou.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Windows\SysWOW64\yatmg.exeC:\Windows\system32\yatmg.exe65⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\iuwlevt.exeC:\Windows\system32\iuwlevt.exe66⤵PID:2160
-
C:\Windows\SysWOW64\psjoh.exeC:\Windows\system32\psjoh.exe67⤵PID:2660
-
C:\Windows\SysWOW64\gqsvxho.exeC:\Windows\system32\gqsvxho.exe68⤵PID:2340
-
C:\Windows\SysWOW64\pkwra.exeC:\Windows\system32\pkwra.exe69⤵PID:2256
-
C:\Windows\SysWOW64\njzftl.exeC:\Windows\system32\njzftl.exe70⤵PID:2564
-
C:\Windows\SysWOW64\nevhk.exeC:\Windows\system32\nevhk.exe71⤵PID:2236
-
C:\Windows\SysWOW64\evhxvto.exeC:\Windows\system32\evhxvto.exe72⤵PID:3004
-
C:\Windows\SysWOW64\xkizbq.exeC:\Windows\system32\xkizbq.exe73⤵PID:2568
-
C:\Windows\SysWOW64\hybvdv.exeC:\Windows\system32\hybvdv.exe74⤵PID:1748
-
C:\Windows\SysWOW64\bqxqeltp.exeC:\Windows\system32\bqxqeltp.exe75⤵PID:2700
-
C:\Windows\SysWOW64\yydlp.exeC:\Windows\system32\yydlp.exe76⤵PID:264
-
C:\Windows\SysWOW64\ysxaz.exeC:\Windows\system32\ysxaz.exe77⤵PID:2352
-
C:\Windows\SysWOW64\mgqxmbm.exeC:\Windows\system32\mgqxmbm.exe78⤵PID:2156
-
C:\Windows\SysWOW64\wtafkcd.exeC:\Windows\system32\wtafkcd.exe79⤵PID:2324
-
C:\Windows\SysWOW64\zgdlfy.exeC:\Windows\system32\zgdlfy.exe80⤵PID:2300
-
C:\Windows\SysWOW64\bhztlff.exeC:\Windows\system32\bhztlff.exe81⤵PID:904
-
C:\Windows\SysWOW64\isdaein.exeC:\Windows\system32\isdaein.exe82⤵PID:3032
-
C:\Windows\SysWOW64\peuctpkl.exeC:\Windows\system32\peuctpkl.exe83⤵PID:2904
-
C:\Windows\SysWOW64\igqea.exeC:\Windows\system32\igqea.exe84⤵PID:884
-
C:\Windows\SysWOW64\wssclivz.exeC:\Windows\system32\wssclivz.exe85⤵PID:1560
-
C:\Windows\SysWOW64\hcxxawgx.exeC:\Windows\system32\hcxxawgx.exe86⤵PID:2800
-
C:\Windows\SysWOW64\jsxjada.exeC:\Windows\system32\jsxjada.exe87⤵PID:2528
-
C:\Windows\SysWOW64\bmnnfwr.exeC:\Windows\system32\bmnnfwr.exe88⤵PID:2956
-
C:\Windows\SysWOW64\vfkfonnp.exeC:\Windows\system32\vfkfonnp.exe89⤵PID:2172
-
C:\Windows\SysWOW64\hilosax.exeC:\Windows\system32\hilosax.exe90⤵PID:300
-
C:\Windows\SysWOW64\utgoxvt.exeC:\Windows\system32\utgoxvt.exe91⤵PID:2788
-
C:\Windows\SysWOW64\drmrrt.exeC:\Windows\system32\drmrrt.exe92⤵PID:988
-
C:\Windows\SysWOW64\lnhblegi.exeC:\Windows\system32\lnhblegi.exe93⤵PID:2120
-
C:\Windows\SysWOW64\rhabtww.exeC:\Windows\system32\rhabtww.exe94⤵PID:2312
-
C:\Windows\SysWOW64\bepvmvw.exeC:\Windows\system32\bepvmvw.exe95⤵PID:304
-
C:\Windows\SysWOW64\hkjxqjsr.exeC:\Windows\system32\hkjxqjsr.exe96⤵PID:568
-
C:\Windows\SysWOW64\afcghd.exeC:\Windows\system32\afcghd.exe97⤵PID:2472
-
C:\Windows\SysWOW64\tvdvxxm.exeC:\Windows\system32\tvdvxxm.exe98⤵PID:2728
-
C:\Windows\SysWOW64\vmneyny.exeC:\Windows\system32\vmneyny.exe99⤵PID:2628
-
C:\Windows\SysWOW64\ceerdjd.exeC:\Windows\system32\ceerdjd.exe100⤵PID:580
-
C:\Windows\SysWOW64\txdowl.exeC:\Windows\system32\txdowl.exe101⤵PID:2752
-
C:\Windows\SysWOW64\zcxwtr.exeC:\Windows\system32\zcxwtr.exe102⤵PID:2036
-
C:\Windows\SysWOW64\oefijsyx.exeC:\Windows\system32\oefijsyx.exe103⤵PID:2276
-
C:\Windows\SysWOW64\ftjqdhn.exeC:\Windows\system32\ftjqdhn.exe104⤵PID:1532
-
C:\Windows\SysWOW64\griqdt.exeC:\Windows\system32\griqdt.exe105⤵PID:2596
-
C:\Windows\SysWOW64\zhiprgqz.exeC:\Windows\system32\zhiprgqz.exe106⤵PID:2520
-
C:\Windows\SysWOW64\zsesimqq.exeC:\Windows\system32\zsesimqq.exe107⤵PID:1616
-
C:\Windows\SysWOW64\gxqlwuzb.exeC:\Windows\system32\gxqlwuzb.exe108⤵PID:2784
-
C:\Windows\SysWOW64\qiheyptj.exeC:\Windows\system32\qiheyptj.exe109⤵PID:2080
-
C:\Windows\SysWOW64\meshpt.exeC:\Windows\system32\meshpt.exe110⤵PID:2428
-
C:\Windows\SysWOW64\ptaujsfp.exeC:\Windows\system32\ptaujsfp.exe111⤵PID:2708
-
C:\Windows\SysWOW64\tyzce.exeC:\Windows\system32\tyzce.exe112⤵PID:2840
-
C:\Windows\SysWOW64\lbrhvaaf.exeC:\Windows\system32\lbrhvaaf.exe113⤵PID:1212
-
C:\Windows\SysWOW64\rlqdvar.exeC:\Windows\system32\rlqdvar.exe114⤵PID:2420
-
C:\Windows\SysWOW64\vruhv.exeC:\Windows\system32\vruhv.exe115⤵PID:2224
-
C:\Windows\SysWOW64\mlvoymhq.exeC:\Windows\system32\mlvoymhq.exe116⤵PID:940
-
C:\Windows\SysWOW64\sxkgxkzt.exeC:\Windows\system32\sxkgxkzt.exe117⤵PID:2216
-
C:\Windows\SysWOW64\jwlkrimg.exeC:\Windows\system32\jwlkrimg.exe118⤵PID:1820
-
C:\Windows\SysWOW64\busikzzi.exeC:\Windows\system32\busikzzi.exe119⤵PID:2516
-
C:\Windows\SysWOW64\qgraevn.exeC:\Windows\system32\qgraevn.exe120⤵PID:3100
-
C:\Windows\SysWOW64\zjwqdnft.exeC:\Windows\system32\zjwqdnft.exe121⤵PID:3132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-