Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 09:33
Behavioral task
behavioral1
Sample
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
-
Size
62KB
-
MD5
737dc259112e73bac5fee84ebfe70d5f
-
SHA1
15883723521e9131d41becb16628b72710975bc1
-
SHA256
28405d61f6990940d9336f1954bee6c6f71ff609a9c3f5e8a9ca66c70dd9a335
-
SHA512
bdfcd9327d733a0f65ab239a209b48d664ff4cc89dd436907b7884dc875a9c8f7f4835aabf95eb99fd348ed6c22df82bdd40c55f522d718e98bcc58fed622590
-
SSDEEP
384:NdYQlviniMRqSG5qxpfnOMzaymeAh5h2vD4lacI/Ws9:NdBd/SGYxdS+AhUMvu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2376 zndugjf.exe 2632 wgyixl.exe 2720 jasidqwo.exe 2604 scmmltzc.exe 2516 faixtbq.exe 2728 lrfeyx.exe 3008 ngxwwvx.exe 1760 tgdvino.exe 1000 hziwhn.exe 2804 sqluzo.exe 2852 nsykazz.exe 1244 khclpgz.exe 1236 svhzjv.exe 2280 hvcqu.exe 1816 hfigrxi.exe 1252 xdrqlyw.exe 2028 xjnss.exe 1772 dowfvy.exe 2388 aalmqis.exe 2680 vrdfs.exe 2132 gdkbxakc.exe 2916 upfmtvrt.exe 1536 biopalaa.exe 848 hornypeg.exe 2248 lzfuxhj.exe 1520 fzdllcyw.exe 796 wocxjepi.exe 2880 ccnfsf.exe 2776 qfjit.exe 1316 wownuoeh.exe 888 eotubak.exe 2284 giehvpzh.exe 2152 xqbqcc.exe 2636 bgudsyl.exe 1620 wdlghj.exe 2640 kamriru.exe 2084 ftzihq.exe 2648 uimutbf.exe 2752 czwgni.exe 2500 oaupzqke.exe 2564 juoguewb.exe 2088 jpqqje.exe 536 vtjkezi.exe 1088 uqtpu.exe 1504 aivmzmc.exe 2816 luhhhue.exe 2840 vwemmqll.exe 1756 tbapu.exe 2172 qdinwiz.exe 1552 ngejq.exe 1148 qyrce.exe 1376 lcmgeie.exe 1432 ufkoelh.exe 2116 fopuowz.exe 2100 bzogeto.exe 1864 uczium.exe 2128 qcmjgldy.exe 2920 izwwljd.exe 1972 fghzyw.exe 812 arbkd.exe 1356 tthgmabl.exe 568 mhepw.exe 2408 fyvon.exe 1968 aqqwf.exe -
Loads dropped DLL 64 IoCs
pid Process 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 2376 zndugjf.exe 2376 zndugjf.exe 2632 wgyixl.exe 2632 wgyixl.exe 2720 jasidqwo.exe 2720 jasidqwo.exe 2604 scmmltzc.exe 2604 scmmltzc.exe 2516 faixtbq.exe 2516 faixtbq.exe 2728 lrfeyx.exe 2728 lrfeyx.exe 3008 ngxwwvx.exe 3008 ngxwwvx.exe 1760 tgdvino.exe 1760 tgdvino.exe 1000 hziwhn.exe 1000 hziwhn.exe 2804 sqluzo.exe 2804 sqluzo.exe 2852 nsykazz.exe 2852 nsykazz.exe 1244 khclpgz.exe 1244 khclpgz.exe 1236 svhzjv.exe 1236 svhzjv.exe 2280 hvcqu.exe 2280 hvcqu.exe 1816 hfigrxi.exe 1816 hfigrxi.exe 1252 xdrqlyw.exe 1252 xdrqlyw.exe 2028 xjnss.exe 2028 xjnss.exe 1772 dowfvy.exe 1772 dowfvy.exe 2388 aalmqis.exe 2388 aalmqis.exe 2680 vrdfs.exe 2680 vrdfs.exe 2132 gdkbxakc.exe 2132 gdkbxakc.exe 2916 upfmtvrt.exe 2916 upfmtvrt.exe 1536 biopalaa.exe 1536 biopalaa.exe 848 hornypeg.exe 848 hornypeg.exe 2248 lzfuxhj.exe 2248 lzfuxhj.exe 1520 fzdllcyw.exe 1520 fzdllcyw.exe 796 wocxjepi.exe 796 wocxjepi.exe 2880 ccnfsf.exe 2880 ccnfsf.exe 2776 qfjit.exe 2776 qfjit.exe 1316 wownuoeh.exe 1316 wownuoeh.exe 888 eotubak.exe 888 eotubak.exe -
resource yara_rule behavioral1/memory/2676-0-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/files/0x000a000000012031-8.dat upx behavioral1/memory/2376-11-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2720-31-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2604-42-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2676-56-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/1760-88-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/1760-100-0x0000000000270000-0x000000000027A000-memory.dmp upx behavioral1/memory/1772-181-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2388-187-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2680-193-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral1/memory/2388-230-0x0000000000260000-0x000000000026A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ccycnrnj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ibbfatkj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nyrle.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xocerlq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bsyko.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ctfgumzk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\khvihu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\znlyzzlq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rgcgab.exe" abaayu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\njoojk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\agbhtfdg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ddhsndg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mtwxlak.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dthtz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vxhmbxi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yvqvmvq.exe" xmypra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zqdiq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lcaospwg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tlipevn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bfrow.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lmijcjz.exe" uokzuy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oswkmes.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dsitklc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qjchxjd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\pheqdkf.exe" csermgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zeijt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ugajdstg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\eisbs.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kykvei.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lmieeur.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yodctelr.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dvwsfjk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ltoys.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\aaqmidil.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bnakg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hrmbxrev.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kswngng.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\agwhgo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ahgstym.exe" vpwqhghd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\gcayode.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yctovpng.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xufxv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tmoqgh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fyvon.exe" mhepw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zkkdf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ghkuj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ltswyj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\koidjct.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\krizqz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qxvtgom.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\maewkuws.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hwzak.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nwmdiy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ppllkfc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hupuls.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vuqbhb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\shfaevff.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tcoru.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jtpwu.exe" taiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xnrbvu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xoxqbha.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oswyoics.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vpyzlxi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vyqeqqt.exe" uyvnxdvq.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\rqoof.exe Process not Found File opened for modification C:\Windows\SysWOW64\npqkved.exe Process not Found File opened for modification C:\Windows\SysWOW64\abqfij.exe Process not Found File created C:\Windows\SysWOW64\udjljolv.exe Process not Found File opened for modification C:\Windows\SysWOW64\lfdjhix.exe Process not Found File created C:\Windows\SysWOW64\ohhgntg.exe Process not Found File opened for modification C:\Windows\SysWOW64\lmijcjz.exe uokzuy.exe File opened for modification C:\Windows\SysWOW64\mvyvlt.exe Process not Found File created C:\Windows\SysWOW64\rjokxna.exe Process not Found File opened for modification C:\Windows\SysWOW64\bzoihsje.exe Process not Found File opened for modification C:\Windows\SysWOW64\uhwqpna.exe Process not Found File opened for modification C:\Windows\SysWOW64\uitnmjxv.exe Process not Found File opened for modification C:\Windows\SysWOW64\bqvac.exe Process not Found File created C:\Windows\SysWOW64\ybabtu.exe Process not Found File created C:\Windows\SysWOW64\mqssk.exe Process not Found File opened for modification C:\Windows\SysWOW64\arldvjdd.exe Process not Found File created C:\Windows\SysWOW64\imioig.exe Process not Found File opened for modification C:\Windows\SysWOW64\kzrea.exe Process not Found File created C:\Windows\SysWOW64\abzfw.exe Process not Found File opened for modification C:\Windows\SysWOW64\kstlpf.exe Process not Found File opened for modification C:\Windows\SysWOW64\hdnfpw.exe Process not Found File created C:\Windows\SysWOW64\sqlwgmcw.exe Process not Found File created C:\Windows\SysWOW64\rzkvepsd.exe Process not Found File created C:\Windows\SysWOW64\fenflc.exe Process not Found File opened for modification C:\Windows\SysWOW64\xlxwot.exe Process not Found File opened for modification C:\Windows\SysWOW64\xokqrr.exe Process not Found File created C:\Windows\SysWOW64\gdjnw.exe Process not Found File opened for modification C:\Windows\SysWOW64\bwqsxifk.exe Process not Found File opened for modification C:\Windows\SysWOW64\mcbtyhrr.exe Process not Found File opened for modification C:\Windows\SysWOW64\xkdxfmjo.exe Process not Found File created C:\Windows\SysWOW64\snehymco.exe Process not Found File opened for modification C:\Windows\SysWOW64\aopgm.exe Process not Found File created C:\Windows\SysWOW64\rgiqwz.exe Process not Found File created C:\Windows\SysWOW64\kcgojl.exe uipmqybl.exe File created C:\Windows\SysWOW64\dxnhtdg.exe gcfxcxt.exe File created C:\Windows\SysWOW64\vkwcw.exe Process not Found File created C:\Windows\SysWOW64\oibjne.exe Process not Found File created C:\Windows\SysWOW64\eisbs.exe Process not Found File created C:\Windows\SysWOW64\sgppto.exe Process not Found File created C:\Windows\SysWOW64\cmrqonti.exe Process not Found File opened for modification C:\Windows\SysWOW64\yttdxpg.exe Process not Found File created C:\Windows\SysWOW64\apazith.exe Process not Found File created C:\Windows\SysWOW64\zfvvmnfi.exe Process not Found File created C:\Windows\SysWOW64\rljdrkwj.exe Process not Found File opened for modification C:\Windows\SysWOW64\mcgjsift.exe Process not Found File created C:\Windows\SysWOW64\ikypgaba.exe Process not Found File opened for modification C:\Windows\SysWOW64\jstgo.exe Process not Found File opened for modification C:\Windows\SysWOW64\ttjuxzu.exe Process not Found File opened for modification C:\Windows\SysWOW64\ytdorovc.exe kphlhzl.exe File created C:\Windows\SysWOW64\asihfi.exe Process not Found File opened for modification C:\Windows\SysWOW64\zvjex.exe Process not Found File opened for modification C:\Windows\SysWOW64\aodrpqcy.exe Process not Found File opened for modification C:\Windows\SysWOW64\iahyuxjy.exe Process not Found File opened for modification C:\Windows\SysWOW64\igqlx.exe Process not Found File opened for modification C:\Windows\SysWOW64\mpxgpmbv.exe Process not Found File opened for modification C:\Windows\SysWOW64\hashusx.exe Process not Found File created C:\Windows\SysWOW64\ldfluzyn.exe Process not Found File created C:\Windows\SysWOW64\bwhpii.exe Process not Found File opened for modification C:\Windows\SysWOW64\eyqnbmg.exe Process not Found File created C:\Windows\SysWOW64\vwluy.exe Process not Found File created C:\Windows\SysWOW64\pvpiove.exe mnesyp.exe File created C:\Windows\SysWOW64\mrfktunf.exe Process not Found File created C:\Windows\SysWOW64\abaayu.exe utsypll.exe File opened for modification C:\Windows\SysWOW64\mfukj.exe Process not Found -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnokkpzx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csansw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cnzwlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wklkkkdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxujma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahansw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe Token: SeDebugPrivilege 2376 zndugjf.exe Token: SeDebugPrivilege 2632 wgyixl.exe Token: SeDebugPrivilege 2720 jasidqwo.exe Token: SeDebugPrivilege 2604 scmmltzc.exe Token: SeDebugPrivilege 2516 faixtbq.exe Token: SeDebugPrivilege 2728 lrfeyx.exe Token: SeDebugPrivilege 3008 ngxwwvx.exe Token: SeDebugPrivilege 1760 tgdvino.exe Token: SeDebugPrivilege 1000 hziwhn.exe Token: SeDebugPrivilege 2804 sqluzo.exe Token: SeDebugPrivilege 2852 nsykazz.exe Token: SeDebugPrivilege 1244 khclpgz.exe Token: SeDebugPrivilege 1236 svhzjv.exe Token: SeDebugPrivilege 2280 hvcqu.exe Token: SeDebugPrivilege 1816 hfigrxi.exe Token: SeDebugPrivilege 1252 xdrqlyw.exe Token: SeDebugPrivilege 2028 xjnss.exe Token: SeDebugPrivilege 1772 dowfvy.exe Token: SeDebugPrivilege 2388 aalmqis.exe Token: SeDebugPrivilege 2680 vrdfs.exe Token: SeDebugPrivilege 2132 gdkbxakc.exe Token: SeDebugPrivilege 2916 upfmtvrt.exe Token: SeDebugPrivilege 1536 biopalaa.exe Token: SeDebugPrivilege 848 hornypeg.exe Token: SeDebugPrivilege 2248 lzfuxhj.exe Token: SeDebugPrivilege 1520 fzdllcyw.exe Token: SeDebugPrivilege 796 wocxjepi.exe Token: SeDebugPrivilege 2880 ccnfsf.exe Token: SeDebugPrivilege 2776 qfjit.exe Token: SeDebugPrivilege 1316 wownuoeh.exe Token: SeDebugPrivilege 888 eotubak.exe Token: SeDebugPrivilege 2284 giehvpzh.exe Token: SeDebugPrivilege 2152 xqbqcc.exe Token: SeDebugPrivilege 2636 bgudsyl.exe Token: SeDebugPrivilege 1620 wdlghj.exe Token: SeDebugPrivilege 2640 kamriru.exe Token: SeDebugPrivilege 2084 ftzihq.exe Token: SeDebugPrivilege 2648 uimutbf.exe Token: SeDebugPrivilege 2752 czwgni.exe Token: SeDebugPrivilege 2500 oaupzqke.exe Token: SeDebugPrivilege 2564 juoguewb.exe Token: SeDebugPrivilege 2088 jpqqje.exe Token: SeDebugPrivilege 536 vtjkezi.exe Token: SeDebugPrivilege 1088 uqtpu.exe Token: SeDebugPrivilege 1504 aivmzmc.exe Token: SeDebugPrivilege 2816 luhhhue.exe Token: SeDebugPrivilege 2840 vwemmqll.exe Token: SeDebugPrivilege 1756 tbapu.exe Token: SeDebugPrivilege 2172 qdinwiz.exe Token: SeDebugPrivilege 1552 ngejq.exe Token: SeDebugPrivilege 1148 qyrce.exe Token: SeDebugPrivilege 1376 lcmgeie.exe Token: SeDebugPrivilege 1432 ufkoelh.exe Token: SeDebugPrivilege 2116 fopuowz.exe Token: SeDebugPrivilege 2100 bzogeto.exe Token: SeDebugPrivilege 1864 uczium.exe Token: SeDebugPrivilege 2128 qcmjgldy.exe Token: SeDebugPrivilege 2920 izwwljd.exe Token: SeDebugPrivilege 1972 fghzyw.exe Token: SeDebugPrivilege 812 arbkd.exe Token: SeDebugPrivilege 1356 tthgmabl.exe Token: SeDebugPrivilege 568 mhepw.exe Token: SeDebugPrivilege 2408 fyvon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2376 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2376 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2376 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 28 PID 2676 wrote to memory of 2376 2676 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 28 PID 2376 wrote to memory of 2632 2376 zndugjf.exe 29 PID 2376 wrote to memory of 2632 2376 zndugjf.exe 29 PID 2376 wrote to memory of 2632 2376 zndugjf.exe 29 PID 2376 wrote to memory of 2632 2376 zndugjf.exe 29 PID 2632 wrote to memory of 2720 2632 wgyixl.exe 30 PID 2632 wrote to memory of 2720 2632 wgyixl.exe 30 PID 2632 wrote to memory of 2720 2632 wgyixl.exe 30 PID 2632 wrote to memory of 2720 2632 wgyixl.exe 30 PID 2720 wrote to memory of 2604 2720 jasidqwo.exe 31 PID 2720 wrote to memory of 2604 2720 jasidqwo.exe 31 PID 2720 wrote to memory of 2604 2720 jasidqwo.exe 31 PID 2720 wrote to memory of 2604 2720 jasidqwo.exe 31 PID 2604 wrote to memory of 2516 2604 scmmltzc.exe 32 PID 2604 wrote to memory of 2516 2604 scmmltzc.exe 32 PID 2604 wrote to memory of 2516 2604 scmmltzc.exe 32 PID 2604 wrote to memory of 2516 2604 scmmltzc.exe 32 PID 2516 wrote to memory of 2728 2516 faixtbq.exe 33 PID 2516 wrote to memory of 2728 2516 faixtbq.exe 33 PID 2516 wrote to memory of 2728 2516 faixtbq.exe 33 PID 2516 wrote to memory of 2728 2516 faixtbq.exe 33 PID 2728 wrote to memory of 3008 2728 lrfeyx.exe 34 PID 2728 wrote to memory of 3008 2728 lrfeyx.exe 34 PID 2728 wrote to memory of 3008 2728 lrfeyx.exe 34 PID 2728 wrote to memory of 3008 2728 lrfeyx.exe 34 PID 3008 wrote to memory of 1760 3008 ngxwwvx.exe 35 PID 3008 wrote to memory of 1760 3008 ngxwwvx.exe 35 PID 3008 wrote to memory of 1760 3008 ngxwwvx.exe 35 PID 3008 wrote to memory of 1760 3008 ngxwwvx.exe 35 PID 1760 wrote to memory of 1000 1760 tgdvino.exe 36 PID 1760 wrote to memory of 1000 1760 tgdvino.exe 36 PID 1760 wrote to memory of 1000 1760 tgdvino.exe 36 PID 1760 wrote to memory of 1000 1760 tgdvino.exe 36 PID 1000 wrote to memory of 2804 1000 hziwhn.exe 37 PID 1000 wrote to memory of 2804 1000 hziwhn.exe 37 PID 1000 wrote to memory of 2804 1000 hziwhn.exe 37 PID 1000 wrote to memory of 2804 1000 hziwhn.exe 37 PID 2804 wrote to memory of 2852 2804 sqluzo.exe 38 PID 2804 wrote to memory of 2852 2804 sqluzo.exe 38 PID 2804 wrote to memory of 2852 2804 sqluzo.exe 38 PID 2804 wrote to memory of 2852 2804 sqluzo.exe 38 PID 2852 wrote to memory of 1244 2852 nsykazz.exe 39 PID 2852 wrote to memory of 1244 2852 nsykazz.exe 39 PID 2852 wrote to memory of 1244 2852 nsykazz.exe 39 PID 2852 wrote to memory of 1244 2852 nsykazz.exe 39 PID 1244 wrote to memory of 1236 1244 khclpgz.exe 40 PID 1244 wrote to memory of 1236 1244 khclpgz.exe 40 PID 1244 wrote to memory of 1236 1244 khclpgz.exe 40 PID 1244 wrote to memory of 1236 1244 khclpgz.exe 40 PID 1236 wrote to memory of 2280 1236 svhzjv.exe 41 PID 1236 wrote to memory of 2280 1236 svhzjv.exe 41 PID 1236 wrote to memory of 2280 1236 svhzjv.exe 41 PID 1236 wrote to memory of 2280 1236 svhzjv.exe 41 PID 2280 wrote to memory of 1816 2280 hvcqu.exe 42 PID 2280 wrote to memory of 1816 2280 hvcqu.exe 42 PID 2280 wrote to memory of 1816 2280 hvcqu.exe 42 PID 2280 wrote to memory of 1816 2280 hvcqu.exe 42 PID 1816 wrote to memory of 1252 1816 hfigrxi.exe 43 PID 1816 wrote to memory of 1252 1816 hfigrxi.exe 43 PID 1816 wrote to memory of 1252 1816 hfigrxi.exe 43 PID 1816 wrote to memory of 1252 1816 hfigrxi.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\zndugjf.exeC:\Windows\system32\zndugjf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\wgyixl.exeC:\Windows\system32\wgyixl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\jasidqwo.exeC:\Windows\system32\jasidqwo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\scmmltzc.exeC:\Windows\system32\scmmltzc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\faixtbq.exeC:\Windows\system32\faixtbq.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\lrfeyx.exeC:\Windows\system32\lrfeyx.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\ngxwwvx.exeC:\Windows\system32\ngxwwvx.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\tgdvino.exeC:\Windows\system32\tgdvino.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\hziwhn.exeC:\Windows\system32\hziwhn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\sqluzo.exeC:\Windows\system32\sqluzo.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\nsykazz.exeC:\Windows\system32\nsykazz.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\khclpgz.exeC:\Windows\system32\khclpgz.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\svhzjv.exeC:\Windows\system32\svhzjv.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\hvcqu.exeC:\Windows\system32\hvcqu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\hfigrxi.exeC:\Windows\system32\hfigrxi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\xdrqlyw.exeC:\Windows\system32\xdrqlyw.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\SysWOW64\xjnss.exeC:\Windows\system32\xjnss.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\dowfvy.exeC:\Windows\system32\dowfvy.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\SysWOW64\aalmqis.exeC:\Windows\system32\aalmqis.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\SysWOW64\vrdfs.exeC:\Windows\system32\vrdfs.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2680 -
C:\Windows\SysWOW64\gdkbxakc.exeC:\Windows\system32\gdkbxakc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Windows\SysWOW64\upfmtvrt.exeC:\Windows\system32\upfmtvrt.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SysWOW64\biopalaa.exeC:\Windows\system32\biopalaa.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\hornypeg.exeC:\Windows\system32\hornypeg.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Windows\SysWOW64\lzfuxhj.exeC:\Windows\system32\lzfuxhj.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2248 -
C:\Windows\SysWOW64\fzdllcyw.exeC:\Windows\system32\fzdllcyw.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\wocxjepi.exeC:\Windows\system32\wocxjepi.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\SysWOW64\ccnfsf.exeC:\Windows\system32\ccnfsf.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2880 -
C:\Windows\SysWOW64\qfjit.exeC:\Windows\system32\qfjit.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\wownuoeh.exeC:\Windows\system32\wownuoeh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1316 -
C:\Windows\SysWOW64\eotubak.exeC:\Windows\system32\eotubak.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Windows\SysWOW64\giehvpzh.exeC:\Windows\system32\giehvpzh.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\SysWOW64\xqbqcc.exeC:\Windows\system32\xqbqcc.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\SysWOW64\bgudsyl.exeC:\Windows\system32\bgudsyl.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Windows\SysWOW64\wdlghj.exeC:\Windows\system32\wdlghj.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\kamriru.exeC:\Windows\system32\kamriru.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Windows\SysWOW64\ftzihq.exeC:\Windows\system32\ftzihq.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Windows\SysWOW64\uimutbf.exeC:\Windows\system32\uimutbf.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\SysWOW64\czwgni.exeC:\Windows\system32\czwgni.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\SysWOW64\oaupzqke.exeC:\Windows\system32\oaupzqke.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\SysWOW64\juoguewb.exeC:\Windows\system32\juoguewb.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SysWOW64\jpqqje.exeC:\Windows\system32\jpqqje.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\vtjkezi.exeC:\Windows\system32\vtjkezi.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536 -
C:\Windows\SysWOW64\uqtpu.exeC:\Windows\system32\uqtpu.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\SysWOW64\aivmzmc.exeC:\Windows\system32\aivmzmc.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1504 -
C:\Windows\SysWOW64\luhhhue.exeC:\Windows\system32\luhhhue.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\SysWOW64\vwemmqll.exeC:\Windows\system32\vwemmqll.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Windows\SysWOW64\tbapu.exeC:\Windows\system32\tbapu.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1756 -
C:\Windows\SysWOW64\qdinwiz.exeC:\Windows\system32\qdinwiz.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\ngejq.exeC:\Windows\system32\ngejq.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1552 -
C:\Windows\SysWOW64\qyrce.exeC:\Windows\system32\qyrce.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148 -
C:\Windows\SysWOW64\lcmgeie.exeC:\Windows\system32\lcmgeie.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1376 -
C:\Windows\SysWOW64\ufkoelh.exeC:\Windows\system32\ufkoelh.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Windows\SysWOW64\fopuowz.exeC:\Windows\system32\fopuowz.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\SysWOW64\bzogeto.exeC:\Windows\system32\bzogeto.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Windows\SysWOW64\uczium.exeC:\Windows\system32\uczium.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1864 -
C:\Windows\SysWOW64\qcmjgldy.exeC:\Windows\system32\qcmjgldy.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\SysWOW64\izwwljd.exeC:\Windows\system32\izwwljd.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920 -
C:\Windows\SysWOW64\fghzyw.exeC:\Windows\system32\fghzyw.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972 -
C:\Windows\SysWOW64\arbkd.exeC:\Windows\system32\arbkd.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:812 -
C:\Windows\SysWOW64\tthgmabl.exeC:\Windows\system32\tthgmabl.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1356 -
C:\Windows\SysWOW64\mhepw.exeC:\Windows\system32\mhepw.exe63⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\SysWOW64\fyvon.exeC:\Windows\system32\fyvon.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2408 -
C:\Windows\SysWOW64\aqqwf.exeC:\Windows\system32\aqqwf.exe65⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\qteyjma.exeC:\Windows\system32\qteyjma.exe66⤵PID:1680
-
C:\Windows\SysWOW64\jgwsjjey.exeC:\Windows\system32\jgwsjjey.exe67⤵PID:2360
-
C:\Windows\SysWOW64\ifmjop.exeC:\Windows\system32\ifmjop.exe68⤵PID:2592
-
C:\Windows\SysWOW64\isunm.exeC:\Windows\system32\isunm.exe69⤵PID:2688
-
C:\Windows\SysWOW64\kydvsrn.exeC:\Windows\system32\kydvsrn.exe70⤵PID:2496
-
C:\Windows\SysWOW64\ehjndj.exeC:\Windows\system32\ehjndj.exe71⤵PID:2864
-
C:\Windows\SysWOW64\gscqi.exeC:\Windows\system32\gscqi.exe72⤵PID:2484
-
C:\Windows\SysWOW64\mhznwso.exeC:\Windows\system32\mhznwso.exe73⤵PID:2764
-
C:\Windows\SysWOW64\uyvnxdvq.exeC:\Windows\system32\uyvnxdvq.exe74⤵
- Adds Run key to start application
PID:772 -
C:\Windows\SysWOW64\vyqeqqt.exeC:\Windows\system32\vyqeqqt.exe75⤵PID:1172
-
C:\Windows\SysWOW64\rwzla.exeC:\Windows\system32\rwzla.exe76⤵PID:2824
-
C:\Windows\SysWOW64\xdnumn.exeC:\Windows\system32\xdnumn.exe77⤵PID:840
-
C:\Windows\SysWOW64\wdglrwic.exeC:\Windows\system32\wdglrwic.exe78⤵PID:1404
-
C:\Windows\SysWOW64\xthunzo.exeC:\Windows\system32\xthunzo.exe79⤵PID:2052
-
C:\Windows\SysWOW64\kguycqj.exeC:\Windows\system32\kguycqj.exe80⤵PID:2548
-
C:\Windows\SysWOW64\rudsklq.exeC:\Windows\system32\rudsklq.exe81⤵PID:2032
-
C:\Windows\SysWOW64\qwhwzx.exeC:\Windows\system32\qwhwzx.exe82⤵PID:2912
-
C:\Windows\SysWOW64\mpayfkcx.exeC:\Windows\system32\mpayfkcx.exe83⤵PID:3016
-
C:\Windows\SysWOW64\ylxwfhc.exeC:\Windows\system32\ylxwfhc.exe84⤵PID:1872
-
C:\Windows\SysWOW64\hqsnowif.exeC:\Windows\system32\hqsnowif.exe85⤵PID:3048
-
C:\Windows\SysWOW64\xyekhc.exeC:\Windows\system32\xyekhc.exe86⤵PID:2432
-
C:\Windows\SysWOW64\grwkct.exeC:\Windows\system32\grwkct.exe87⤵PID:2296
-
C:\Windows\SysWOW64\yyjwwy.exeC:\Windows\system32\yyjwwy.exe88⤵PID:2068
-
C:\Windows\SysWOW64\vnongb.exeC:\Windows\system32\vnongb.exe89⤵PID:1932
-
C:\Windows\SysWOW64\xsobh.exeC:\Windows\system32\xsobh.exe90⤵PID:2756
-
C:\Windows\SysWOW64\hmqpdtqh.exeC:\Windows\system32\hmqpdtqh.exe91⤵PID:2532
-
C:\Windows\SysWOW64\bmhtz.exeC:\Windows\system32\bmhtz.exe92⤵PID:2964
-
C:\Windows\SysWOW64\jngri.exeC:\Windows\system32\jngri.exe93⤵PID:1496
-
C:\Windows\SysWOW64\bosarzqk.exeC:\Windows\system32\bosarzqk.exe94⤵PID:1160
-
C:\Windows\SysWOW64\iihdkrvn.exeC:\Windows\system32\iihdkrvn.exe95⤵PID:1656
-
C:\Windows\SysWOW64\edeiigvg.exeC:\Windows\system32\edeiigvg.exe96⤵PID:1068
-
C:\Windows\SysWOW64\cfmouq.exeC:\Windows\system32\cfmouq.exe97⤵PID:2364
-
C:\Windows\SysWOW64\szcza.exeC:\Windows\system32\szcza.exe98⤵PID:2124
-
C:\Windows\SysWOW64\yjjfx.exeC:\Windows\system32\yjjfx.exe99⤵PID:1188
-
C:\Windows\SysWOW64\pblms.exeC:\Windows\system32\pblms.exe100⤵PID:2940
-
C:\Windows\SysWOW64\hyhotuqw.exeC:\Windows\system32\hyhotuqw.exe101⤵PID:3060
-
C:\Windows\SysWOW64\nbzynbfh.exeC:\Windows\system32\nbzynbfh.exe102⤵PID:2612
-
C:\Windows\SysWOW64\fkxwuzs.exeC:\Windows\system32\fkxwuzs.exe103⤵PID:2600
-
C:\Windows\SysWOW64\disjiekn.exeC:\Windows\system32\disjiekn.exe104⤵PID:2748
-
C:\Windows\SysWOW64\ngdri.exeC:\Windows\system32\ngdri.exe105⤵PID:1600
-
C:\Windows\SysWOW64\bwyoppm.exeC:\Windows\system32\bwyoppm.exe106⤵PID:2020
-
C:\Windows\SysWOW64\zbyjdi.exeC:\Windows\system32\zbyjdi.exe107⤵PID:2424
-
C:\Windows\SysWOW64\awzzv.exeC:\Windows\system32\awzzv.exe108⤵PID:916
-
C:\Windows\SysWOW64\tyoxkh.exeC:\Windows\system32\tyoxkh.exe109⤵PID:1460
-
C:\Windows\SysWOW64\dazryso.exeC:\Windows\system32\dazryso.exe110⤵PID:2784
-
C:\Windows\SysWOW64\dlyjgtos.exeC:\Windows\system32\dlyjgtos.exe111⤵PID:744
-
C:\Windows\SysWOW64\kzenyrzm.exeC:\Windows\system32\kzenyrzm.exe112⤵PID:1616
-
C:\Windows\SysWOW64\hxobuua.exeC:\Windows\system32\hxobuua.exe113⤵PID:2060
-
C:\Windows\SysWOW64\jvdvk.exeC:\Windows\system32\jvdvk.exe114⤵PID:1608
-
C:\Windows\SysWOW64\mopgkim.exeC:\Windows\system32\mopgkim.exe115⤵PID:2732
-
C:\Windows\SysWOW64\bnrjdoq.exeC:\Windows\system32\bnrjdoq.exe116⤵PID:2224
-
C:\Windows\SysWOW64\gvczw.exeC:\Windows\system32\gvczw.exe117⤵PID:2216
-
C:\Windows\SysWOW64\uiiycmg.exeC:\Windows\system32\uiiycmg.exe118⤵PID:2520
-
C:\Windows\SysWOW64\kvqgg.exeC:\Windows\system32\kvqgg.exe119⤵PID:1092
-
C:\Windows\SysWOW64\owgjipt.exeC:\Windows\system32\owgjipt.exe120⤵PID:2836
-
C:\Windows\SysWOW64\cezgqsrx.exeC:\Windows\system32\cezgqsrx.exe121⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-