Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 09:33
Behavioral task
behavioral1
Sample
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe
-
Size
62KB
-
MD5
737dc259112e73bac5fee84ebfe70d5f
-
SHA1
15883723521e9131d41becb16628b72710975bc1
-
SHA256
28405d61f6990940d9336f1954bee6c6f71ff609a9c3f5e8a9ca66c70dd9a335
-
SHA512
bdfcd9327d733a0f65ab239a209b48d664ff4cc89dd436907b7884dc875a9c8f7f4835aabf95eb99fd348ed6c22df82bdd40c55f522d718e98bcc58fed622590
-
SSDEEP
384:NdYQlviniMRqSG5qxpfnOMzaymeAh5h2vD4lacI/Ws9:NdBd/SGYxdS+AhUMvu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1600 fjgwrnyf.exe 3028 lzdkpctb.exe 4616 lkdvvzd.exe 4176 nawke.exe 5000 izwde.exe 5076 cayhaj.exe 4960 dlgwh.exe 5044 zhrawua.exe 1488 upojvp.exe 1728 pfbxyo.exe 2960 ffyklhlk.exe 3368 rupilomi.exe 4076 hnsks.exe 4220 edflgk.exe 4920 kwcpl.exe 3064 pzhky.exe 1540 lxgypaah.exe 1432 icxnvvb.exe 2984 xfxjd.exe 3904 rrrip.exe 2012 trftlrp.exe 1016 vsmzyif.exe 3052 edjkle.exe 1416 hmyzn.exe 1648 mylrztj.exe 3920 arjgem.exe 3812 snpsg.exe 5056 fnwbf.exe 2404 kyexjsc.exe 4724 rtyaf.exe 1568 rwtgk.exe 2648 oahoygv.exe 4932 txlsoxu.exe 3548 qipluhl.exe 2220 lqponk.exe 780 esvarx.exe 2632 zoypnva.exe 1676 gzdtwxca.exe 2468 lfzrjlj.exe 4556 tbqaco.exe 228 yjyhz.exe 4888 dmwucvr.exe 4788 fvyomg.exe 1280 mccuznt.exe 2148 qisqbr.exe 3668 ycnfvlt.exe 4316 rjumw.exe 4196 dgkca.exe 3244 ncjez.exe 3964 wclvcrij.exe 2712 bvkjdgt.exe 2932 ytzxhk.exe 3992 vluhh.exe 1536 oaxcojdn.exe 2940 cawklv.exe 64 dvjmzrm.exe 1236 unfwg.exe 1220 qnpoug.exe 4424 uusfjzb.exe 3328 gagmfw.exe 764 mvzzkhb.exe 3972 lqievejp.exe 4496 swwda.exe 812 naeyqzv.exe -
resource yara_rule behavioral2/memory/376-0-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/files/0x00090000000233ce-3.dat upx behavioral2/memory/1600-6-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/376-42-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/4616-54-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/4220-99-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/2012-128-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/2648-134-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/2940-181-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/64-205-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/4328-273-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/6756-429-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/7280-513-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/7952-568-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/9244-767-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/9296-792-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/9836-835-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/15788-1703-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/2012-1884-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/1836-2182-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/17312-2167-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/3328-2226-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/6112-2486-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/6964-2724-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/6420-3382-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/7968-4494-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/16152-6241-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/14432-6370-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/16452-6457-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/3832-7028-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/3100-7625-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/9468-8397-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/11280-10368-0x0000000031420000-0x000000003142A000-memory.dmp upx behavioral2/memory/2316-11209-0x0000000031420000-0x000000003142A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zoelzsj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mnsiirvu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vnwurs.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nizteo.exe" yqoyjsew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\maanzx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\aacgbq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fogdl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\efxrx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ilmya.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\gwomdt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ivkcbdzt.exe" vuormga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ygzawqoi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\andjtxni.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ffovlex.exe" wfumod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cfukddtp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rxufjl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ynxnmp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qlggpky.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uuobfwkd.exe" pptrdlu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yofsh.exe" mjwrafh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ntrkt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xmlozsv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wansclq.exe" hfwrjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nrdvppv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dgutqs.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bzwyh.exe" ljjgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lmxuns.exe" ramnqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sptzdn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jwwrybit.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dlcuuca.exe" bxrru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uwvnslq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kboyq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qawszy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\azxpl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qxyhnk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tjtgd.exe" bijdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xlivqdt.exe" lrczf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fxkpuv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bpjtk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ritvch.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uiyixm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ogswe.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\iuteuqkf.exe" sgasowev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ufrhiw.exe" obfah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yxlvns.exe" jvamz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fczwwnp.exe" qhwlvsg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wruouli.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uthre.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\pwrue.exe" gggevukm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wfumod.exe" vqlac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rhqayfj.exe" feqorgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tlvygtne.exe" oyylx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qgoussa.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hkeqjb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yfphfwmc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zdbtv.exe" paotra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vdhycvj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\reely.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wroqw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\krodeb.exe" phytfmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lrczf.exe" tsfgeea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ovcymt.exe" igfmgegb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\eeilhjy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\treck.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\njcuodye.exe Process not Found File opened for modification C:\Windows\SysWOW64\ddobq.exe Process not Found File opened for modification C:\Windows\SysWOW64\ltqelfwl.exe Process not Found File created C:\Windows\SysWOW64\pdxee.exe Process not Found File opened for modification C:\Windows\SysWOW64\rrfma.exe Process not Found File created C:\Windows\SysWOW64\jiewh.exe oumkcoen.exe File created C:\Windows\SysWOW64\vkloj.exe Process not Found File created C:\Windows\SysWOW64\gaqgsqz.exe Process not Found File created C:\Windows\SysWOW64\jjnmflrw.exe Process not Found File opened for modification C:\Windows\SysWOW64\jqmmir.exe xqbsxiqq.exe File opened for modification C:\Windows\SysWOW64\ieaxbv.exe Process not Found File created C:\Windows\SysWOW64\dualdmg.exe Process not Found File created C:\Windows\SysWOW64\gdfala.exe Process not Found File opened for modification C:\Windows\SysWOW64\sljcl.exe Process not Found File created C:\Windows\SysWOW64\vjvzzjyw.exe Process not Found File opened for modification C:\Windows\SysWOW64\skbdmn.exe bwlwad.exe File created C:\Windows\SysWOW64\sxpblz.exe Process not Found File created C:\Windows\SysWOW64\dwkqqq.exe Process not Found File created C:\Windows\SysWOW64\utnczm.exe lxigh.exe File opened for modification C:\Windows\SysWOW64\zyjzr.exe Process not Found File created C:\Windows\SysWOW64\pqqpejv.exe Process not Found File created C:\Windows\SysWOW64\thyoxya.exe sedmsyf.exe File created C:\Windows\SysWOW64\akpobla.exe Process not Found File opened for modification C:\Windows\SysWOW64\cgxtjqn.exe Process not Found File created C:\Windows\SysWOW64\wdboz.exe Process not Found File created C:\Windows\SysWOW64\pfbxyo.exe upojvp.exe File created C:\Windows\SysWOW64\tiofbw.exe ssppyy.exe File opened for modification C:\Windows\SysWOW64\oiwlurz.exe Process not Found File created C:\Windows\SysWOW64\rnfuxco.exe Process not Found File opened for modification C:\Windows\SysWOW64\fajxukf.exe Process not Found File created C:\Windows\SysWOW64\xttwimrh.exe Process not Found File created C:\Windows\SysWOW64\xlezzo.exe ngtywq.exe File opened for modification C:\Windows\SysWOW64\jgbkx.exe oymuni.exe File created C:\Windows\SysWOW64\itwza.exe Process not Found File opened for modification C:\Windows\SysWOW64\hxziymi.exe Process not Found File created C:\Windows\SysWOW64\wpxfulda.exe Process not Found File created C:\Windows\SysWOW64\afiuou.exe Process not Found File created C:\Windows\SysWOW64\wdhjbuu.exe Process not Found File opened for modification C:\Windows\SysWOW64\lxopj.exe Process not Found File opened for modification C:\Windows\SysWOW64\qfphmgsx.exe Process not Found File opened for modification C:\Windows\SysWOW64\qzxijxbq.exe Process not Found File created C:\Windows\SysWOW64\ddzrr.exe Process not Found File opened for modification C:\Windows\SysWOW64\sczby.exe Process not Found File created C:\Windows\SysWOW64\qfkmw.exe ggjza.exe File opened for modification C:\Windows\SysWOW64\lechcnhd.exe dvcqh.exe File created C:\Windows\SysWOW64\ntsgot.exe Process not Found File created C:\Windows\SysWOW64\zqxkwfq.exe xdiipx.exe File opened for modification C:\Windows\SysWOW64\owygk.exe Process not Found File opened for modification C:\Windows\SysWOW64\zauii.exe Process not Found File created C:\Windows\SysWOW64\lklvtdyv.exe caphg.exe File opened for modification C:\Windows\SysWOW64\wqmsglw.exe qpkcxqg.exe File opened for modification C:\Windows\SysWOW64\kucmp.exe ttbastjg.exe File created C:\Windows\SysWOW64\gmfgva.exe Process not Found File created C:\Windows\SysWOW64\oeikptnk.exe Process not Found File created C:\Windows\SysWOW64\llozegk.exe Process not Found File created C:\Windows\SysWOW64\plfeaqv.exe Process not Found File created C:\Windows\SysWOW64\oymuni.exe urujtepu.exe File created C:\Windows\SysWOW64\tijhfaew.exe pwrue.exe File created C:\Windows\SysWOW64\oifnh.exe binqnpb.exe File opened for modification C:\Windows\SysWOW64\rqadtla.exe hxmhym.exe File opened for modification C:\Windows\SysWOW64\fxypz.exe Process not Found File opened for modification C:\Windows\SysWOW64\orpoevq.exe Process not Found File created C:\Windows\SysWOW64\znoawvsn.exe Process not Found File opened for modification C:\Windows\SysWOW64\txhbz.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbqaco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omkwiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pybfscfm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ovcymt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svilbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aoxpkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hcqhlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftqdmpgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txlsoxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qqnydcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oqsateo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uqpeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdeyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qvvqzoo.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 376 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe Token: SeDebugPrivilege 1600 fjgwrnyf.exe Token: SeDebugPrivilege 3028 lzdkpctb.exe Token: SeDebugPrivilege 4616 lkdvvzd.exe Token: SeDebugPrivilege 4176 nawke.exe Token: SeDebugPrivilege 5000 izwde.exe Token: SeDebugPrivilege 5076 cayhaj.exe Token: SeDebugPrivilege 4960 dlgwh.exe Token: SeDebugPrivilege 5044 zhrawua.exe Token: SeDebugPrivilege 1488 upojvp.exe Token: SeDebugPrivilege 1728 pfbxyo.exe Token: SeDebugPrivilege 2960 ffyklhlk.exe Token: SeDebugPrivilege 3368 rupilomi.exe Token: SeDebugPrivilege 4076 hnsks.exe Token: SeDebugPrivilege 4220 edflgk.exe Token: SeDebugPrivilege 4920 kwcpl.exe Token: SeDebugPrivilege 3064 pzhky.exe Token: SeDebugPrivilege 1540 lxgypaah.exe Token: SeDebugPrivilege 1432 icxnvvb.exe Token: SeDebugPrivilege 2984 xfxjd.exe Token: SeDebugPrivilege 3904 rrrip.exe Token: SeDebugPrivilege 2012 trftlrp.exe Token: SeDebugPrivilege 1016 vsmzyif.exe Token: SeDebugPrivilege 3052 edjkle.exe Token: SeDebugPrivilege 1416 hmyzn.exe Token: SeDebugPrivilege 1648 mylrztj.exe Token: SeDebugPrivilege 3920 arjgem.exe Token: SeDebugPrivilege 3812 snpsg.exe Token: SeDebugPrivilege 5056 fnwbf.exe Token: SeDebugPrivilege 2404 kyexjsc.exe Token: SeDebugPrivilege 4724 rtyaf.exe Token: SeDebugPrivilege 1568 rwtgk.exe Token: SeDebugPrivilege 2648 oahoygv.exe Token: SeDebugPrivilege 4932 txlsoxu.exe Token: SeDebugPrivilege 3548 qipluhl.exe Token: SeDebugPrivilege 2220 lqponk.exe Token: SeDebugPrivilege 780 esvarx.exe Token: SeDebugPrivilege 2632 zoypnva.exe Token: SeDebugPrivilege 1676 gzdtwxca.exe Token: SeDebugPrivilege 2468 lfzrjlj.exe Token: SeDebugPrivilege 4556 tbqaco.exe Token: SeDebugPrivilege 228 yjyhz.exe Token: SeDebugPrivilege 4888 dmwucvr.exe Token: SeDebugPrivilege 4788 fvyomg.exe Token: SeDebugPrivilege 1280 mccuznt.exe Token: SeDebugPrivilege 2148 qisqbr.exe Token: SeDebugPrivilege 3668 ycnfvlt.exe Token: SeDebugPrivilege 4316 rjumw.exe Token: SeDebugPrivilege 4196 dgkca.exe Token: SeDebugPrivilege 3244 ncjez.exe Token: SeDebugPrivilege 3964 wclvcrij.exe Token: SeDebugPrivilege 2712 bvkjdgt.exe Token: SeDebugPrivilege 2932 ytzxhk.exe Token: SeDebugPrivilege 3992 vluhh.exe Token: SeDebugPrivilege 1536 oaxcojdn.exe Token: SeDebugPrivilege 2940 cawklv.exe Token: SeDebugPrivilege 64 dvjmzrm.exe Token: SeDebugPrivilege 1236 unfwg.exe Token: SeDebugPrivilege 1220 qnpoug.exe Token: SeDebugPrivilege 4424 uusfjzb.exe Token: SeDebugPrivilege 3328 gagmfw.exe Token: SeDebugPrivilege 764 mvzzkhb.exe Token: SeDebugPrivilege 3972 lqievejp.exe Token: SeDebugPrivilege 4496 swwda.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 376 wrote to memory of 1600 376 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 84 PID 376 wrote to memory of 1600 376 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 84 PID 376 wrote to memory of 1600 376 737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe 84 PID 1600 wrote to memory of 3028 1600 fjgwrnyf.exe 85 PID 1600 wrote to memory of 3028 1600 fjgwrnyf.exe 85 PID 1600 wrote to memory of 3028 1600 fjgwrnyf.exe 85 PID 3028 wrote to memory of 4616 3028 lzdkpctb.exe 86 PID 3028 wrote to memory of 4616 3028 lzdkpctb.exe 86 PID 3028 wrote to memory of 4616 3028 lzdkpctb.exe 86 PID 4616 wrote to memory of 4176 4616 lkdvvzd.exe 87 PID 4616 wrote to memory of 4176 4616 lkdvvzd.exe 87 PID 4616 wrote to memory of 4176 4616 lkdvvzd.exe 87 PID 4176 wrote to memory of 5000 4176 nawke.exe 88 PID 4176 wrote to memory of 5000 4176 nawke.exe 88 PID 4176 wrote to memory of 5000 4176 nawke.exe 88 PID 5000 wrote to memory of 5076 5000 izwde.exe 89 PID 5000 wrote to memory of 5076 5000 izwde.exe 89 PID 5000 wrote to memory of 5076 5000 izwde.exe 89 PID 5076 wrote to memory of 4960 5076 cayhaj.exe 90 PID 5076 wrote to memory of 4960 5076 cayhaj.exe 90 PID 5076 wrote to memory of 4960 5076 cayhaj.exe 90 PID 4960 wrote to memory of 5044 4960 dlgwh.exe 91 PID 4960 wrote to memory of 5044 4960 dlgwh.exe 91 PID 4960 wrote to memory of 5044 4960 dlgwh.exe 91 PID 5044 wrote to memory of 1488 5044 zhrawua.exe 92 PID 5044 wrote to memory of 1488 5044 zhrawua.exe 92 PID 5044 wrote to memory of 1488 5044 zhrawua.exe 92 PID 1488 wrote to memory of 1728 1488 upojvp.exe 93 PID 1488 wrote to memory of 1728 1488 upojvp.exe 93 PID 1488 wrote to memory of 1728 1488 upojvp.exe 93 PID 1728 wrote to memory of 2960 1728 pfbxyo.exe 94 PID 1728 wrote to memory of 2960 1728 pfbxyo.exe 94 PID 1728 wrote to memory of 2960 1728 pfbxyo.exe 94 PID 2960 wrote to memory of 3368 2960 ffyklhlk.exe 95 PID 2960 wrote to memory of 3368 2960 ffyklhlk.exe 95 PID 2960 wrote to memory of 3368 2960 ffyklhlk.exe 95 PID 3368 wrote to memory of 4076 3368 rupilomi.exe 96 PID 3368 wrote to memory of 4076 3368 rupilomi.exe 96 PID 3368 wrote to memory of 4076 3368 rupilomi.exe 96 PID 4076 wrote to memory of 4220 4076 hnsks.exe 97 PID 4076 wrote to memory of 4220 4076 hnsks.exe 97 PID 4076 wrote to memory of 4220 4076 hnsks.exe 97 PID 4220 wrote to memory of 4920 4220 edflgk.exe 98 PID 4220 wrote to memory of 4920 4220 edflgk.exe 98 PID 4220 wrote to memory of 4920 4220 edflgk.exe 98 PID 4920 wrote to memory of 3064 4920 kwcpl.exe 99 PID 4920 wrote to memory of 3064 4920 kwcpl.exe 99 PID 4920 wrote to memory of 3064 4920 kwcpl.exe 99 PID 3064 wrote to memory of 1540 3064 pzhky.exe 100 PID 3064 wrote to memory of 1540 3064 pzhky.exe 100 PID 3064 wrote to memory of 1540 3064 pzhky.exe 100 PID 1540 wrote to memory of 1432 1540 lxgypaah.exe 101 PID 1540 wrote to memory of 1432 1540 lxgypaah.exe 101 PID 1540 wrote to memory of 1432 1540 lxgypaah.exe 101 PID 1432 wrote to memory of 2984 1432 icxnvvb.exe 102 PID 1432 wrote to memory of 2984 1432 icxnvvb.exe 102 PID 1432 wrote to memory of 2984 1432 icxnvvb.exe 102 PID 2984 wrote to memory of 3904 2984 xfxjd.exe 104 PID 2984 wrote to memory of 3904 2984 xfxjd.exe 104 PID 2984 wrote to memory of 3904 2984 xfxjd.exe 104 PID 3904 wrote to memory of 2012 3904 rrrip.exe 105 PID 3904 wrote to memory of 2012 3904 rrrip.exe 105 PID 3904 wrote to memory of 2012 3904 rrrip.exe 105 PID 2012 wrote to memory of 1016 2012 trftlrp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\737dc259112e73bac5fee84ebfe70d5f_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\fjgwrnyf.exeC:\Windows\system32\fjgwrnyf.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\lzdkpctb.exeC:\Windows\system32\lzdkpctb.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\lkdvvzd.exeC:\Windows\system32\lkdvvzd.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\nawke.exeC:\Windows\system32\nawke.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\izwde.exeC:\Windows\system32\izwde.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cayhaj.exeC:\Windows\system32\cayhaj.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\dlgwh.exeC:\Windows\system32\dlgwh.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\zhrawua.exeC:\Windows\system32\zhrawua.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\upojvp.exeC:\Windows\system32\upojvp.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\pfbxyo.exeC:\Windows\system32\pfbxyo.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\ffyklhlk.exeC:\Windows\system32\ffyklhlk.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\rupilomi.exeC:\Windows\system32\rupilomi.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\hnsks.exeC:\Windows\system32\hnsks.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\edflgk.exeC:\Windows\system32\edflgk.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\kwcpl.exeC:\Windows\system32\kwcpl.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\pzhky.exeC:\Windows\system32\pzhky.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\lxgypaah.exeC:\Windows\system32\lxgypaah.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\icxnvvb.exeC:\Windows\system32\icxnvvb.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\xfxjd.exeC:\Windows\system32\xfxjd.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\rrrip.exeC:\Windows\system32\rrrip.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\trftlrp.exeC:\Windows\system32\trftlrp.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\vsmzyif.exeC:\Windows\system32\vsmzyif.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Windows\SysWOW64\edjkle.exeC:\Windows\system32\edjkle.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\SysWOW64\hmyzn.exeC:\Windows\system32\hmyzn.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\SysWOW64\mylrztj.exeC:\Windows\system32\mylrztj.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\arjgem.exeC:\Windows\system32\arjgem.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920 -
C:\Windows\SysWOW64\snpsg.exeC:\Windows\system32\snpsg.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Windows\SysWOW64\fnwbf.exeC:\Windows\system32\fnwbf.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056 -
C:\Windows\SysWOW64\kyexjsc.exeC:\Windows\system32\kyexjsc.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\SysWOW64\rtyaf.exeC:\Windows\system32\rtyaf.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4724 -
C:\Windows\SysWOW64\rwtgk.exeC:\Windows\system32\rwtgk.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\oahoygv.exeC:\Windows\system32\oahoygv.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\SysWOW64\txlsoxu.exeC:\Windows\system32\txlsoxu.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4932 -
C:\Windows\SysWOW64\qipluhl.exeC:\Windows\system32\qipluhl.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3548 -
C:\Windows\SysWOW64\lqponk.exeC:\Windows\system32\lqponk.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2220 -
C:\Windows\SysWOW64\esvarx.exeC:\Windows\system32\esvarx.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:780 -
C:\Windows\SysWOW64\zoypnva.exeC:\Windows\system32\zoypnva.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\SysWOW64\gzdtwxca.exeC:\Windows\system32\gzdtwxca.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Windows\SysWOW64\lfzrjlj.exeC:\Windows\system32\lfzrjlj.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\SysWOW64\tbqaco.exeC:\Windows\system32\tbqaco.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\yjyhz.exeC:\Windows\system32\yjyhz.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Windows\SysWOW64\dmwucvr.exeC:\Windows\system32\dmwucvr.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888 -
C:\Windows\SysWOW64\fvyomg.exeC:\Windows\system32\fvyomg.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4788 -
C:\Windows\SysWOW64\mccuznt.exeC:\Windows\system32\mccuznt.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Windows\SysWOW64\qisqbr.exeC:\Windows\system32\qisqbr.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\SysWOW64\ycnfvlt.exeC:\Windows\system32\ycnfvlt.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Windows\SysWOW64\rjumw.exeC:\Windows\system32\rjumw.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4316 -
C:\Windows\SysWOW64\dgkca.exeC:\Windows\system32\dgkca.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196 -
C:\Windows\SysWOW64\ncjez.exeC:\Windows\system32\ncjez.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244 -
C:\Windows\SysWOW64\wclvcrij.exeC:\Windows\system32\wclvcrij.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3964 -
C:\Windows\SysWOW64\bvkjdgt.exeC:\Windows\system32\bvkjdgt.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\ytzxhk.exeC:\Windows\system32\ytzxhk.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Windows\SysWOW64\vluhh.exeC:\Windows\system32\vluhh.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3992 -
C:\Windows\SysWOW64\oaxcojdn.exeC:\Windows\system32\oaxcojdn.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\cawklv.exeC:\Windows\system32\cawklv.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Windows\SysWOW64\dvjmzrm.exeC:\Windows\system32\dvjmzrm.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:64 -
C:\Windows\SysWOW64\unfwg.exeC:\Windows\system32\unfwg.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\SysWOW64\qnpoug.exeC:\Windows\system32\qnpoug.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\SysWOW64\uusfjzb.exeC:\Windows\system32\uusfjzb.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424 -
C:\Windows\SysWOW64\gagmfw.exeC:\Windows\system32\gagmfw.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328 -
C:\Windows\SysWOW64\mvzzkhb.exeC:\Windows\system32\mvzzkhb.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764 -
C:\Windows\SysWOW64\lqievejp.exeC:\Windows\system32\lqievejp.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Windows\SysWOW64\swwda.exeC:\Windows\system32\swwda.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496 -
C:\Windows\SysWOW64\naeyqzv.exeC:\Windows\system32\naeyqzv.exe65⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\qkwixgr.exeC:\Windows\system32\qkwixgr.exe66⤵PID:432
-
C:\Windows\SysWOW64\gpwshem.exeC:\Windows\system32\gpwshem.exe67⤵PID:4612
-
C:\Windows\SysWOW64\barxdccx.exeC:\Windows\system32\barxdccx.exe68⤵PID:2244
-
C:\Windows\SysWOW64\vrkqeez.exeC:\Windows\system32\vrkqeez.exe69⤵PID:1020
-
C:\Windows\SysWOW64\rvzcqhz.exeC:\Windows\system32\rvzcqhz.exe70⤵PID:4792
-
C:\Windows\SysWOW64\ausezbkb.exeC:\Windows\system32\ausezbkb.exe71⤵PID:1176
-
C:\Windows\SysWOW64\rmtdmh.exeC:\Windows\system32\rmtdmh.exe72⤵PID:3772
-
C:\Windows\SysWOW64\mekrss.exeC:\Windows\system32\mekrss.exe73⤵PID:3276
-
C:\Windows\SysWOW64\zqwjemja.exeC:\Windows\system32\zqwjemja.exe74⤵PID:2688
-
C:\Windows\SysWOW64\ckmxrqkp.exeC:\Windows\system32\ckmxrqkp.exe75⤵PID:3340
-
C:\Windows\SysWOW64\caphg.exeC:\Windows\system32\caphg.exe76⤵
- Drops file in System32 directory
PID:4324 -
C:\Windows\SysWOW64\lklvtdyv.exeC:\Windows\system32\lklvtdyv.exe77⤵PID:3456
-
C:\Windows\SysWOW64\oinpmavq.exeC:\Windows\system32\oinpmavq.exe78⤵PID:1128
-
C:\Windows\SysWOW64\hgknefep.exeC:\Windows\system32\hgknefep.exe79⤵PID:1444
-
C:\Windows\SysWOW64\sfrpkjb.exeC:\Windows\system32\sfrpkjb.exe80⤵PID:2088
-
C:\Windows\SysWOW64\ykcjqgdw.exeC:\Windows\system32\ykcjqgdw.exe81⤵PID:2368
-
C:\Windows\SysWOW64\kerasd.exeC:\Windows\system32\kerasd.exe82⤵PID:3140
-
C:\Windows\SysWOW64\skkif.exeC:\Windows\system32\skkif.exe83⤵PID:3560
-
C:\Windows\SysWOW64\yedgt.exeC:\Windows\system32\yedgt.exe84⤵PID:628
-
C:\Windows\SysWOW64\jsbxdfo.exeC:\Windows\system32\jsbxdfo.exe85⤵PID:2252
-
C:\Windows\SysWOW64\gdozho.exeC:\Windows\system32\gdozho.exe86⤵PID:2472
-
C:\Windows\SysWOW64\edpud.exeC:\Windows\system32\edpud.exe87⤵PID:4440
-
C:\Windows\SysWOW64\pybfscfm.exeC:\Windows\system32\pybfscfm.exe88⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Windows\SysWOW64\mnatkzxz.exeC:\Windows\system32\mnatkzxz.exe89⤵PID:4836
-
C:\Windows\SysWOW64\qhbsoe.exeC:\Windows\system32\qhbsoe.exe90⤵PID:1616
-
C:\Windows\SysWOW64\wvtyg.exeC:\Windows\system32\wvtyg.exe91⤵PID:4068
-
C:\Windows\SysWOW64\xfscnj.exeC:\Windows\system32\xfscnj.exe92⤵PID:4328
-
C:\Windows\SysWOW64\ybtsrnaz.exeC:\Windows\system32\ybtsrnaz.exe93⤵PID:2664
-
C:\Windows\SysWOW64\ohsxsafd.exeC:\Windows\system32\ohsxsafd.exe94⤵PID:4180
-
C:\Windows\SysWOW64\aecvia.exeC:\Windows\system32\aecvia.exe95⤵PID:5144
-
C:\Windows\SysWOW64\sxxqww.exeC:\Windows\system32\sxxqww.exe96⤵PID:5168
-
C:\Windows\SysWOW64\nahwouo.exeC:\Windows\system32\nahwouo.exe97⤵PID:5192
-
C:\Windows\SysWOW64\odsufsjr.exeC:\Windows\system32\odsufsjr.exe98⤵PID:5240
-
C:\Windows\SysWOW64\vscerdk.exeC:\Windows\system32\vscerdk.exe99⤵PID:5268
-
C:\Windows\SysWOW64\kbglz.exeC:\Windows\system32\kbglz.exe100⤵PID:5312
-
C:\Windows\SysWOW64\pnhtzlyn.exeC:\Windows\system32\pnhtzlyn.exe101⤵PID:5336
-
C:\Windows\SysWOW64\klpyrcv.exeC:\Windows\system32\klpyrcv.exe102⤵PID:5360
-
C:\Windows\SysWOW64\dzfvaeeh.exeC:\Windows\system32\dzfvaeeh.exe103⤵PID:5388
-
C:\Windows\SysWOW64\fwlnu.exeC:\Windows\system32\fwlnu.exe104⤵PID:5412
-
C:\Windows\SysWOW64\vouuea.exeC:\Windows\system32\vouuea.exe105⤵PID:5436
-
C:\Windows\SysWOW64\dwiurd.exeC:\Windows\system32\dwiurd.exe106⤵PID:5460
-
C:\Windows\SysWOW64\tkhrjm.exeC:\Windows\system32\tkhrjm.exe107⤵PID:5488
-
C:\Windows\SysWOW64\bfvegnqh.exeC:\Windows\system32\bfvegnqh.exe108⤵PID:5512
-
C:\Windows\SysWOW64\muavhbrm.exeC:\Windows\system32\muavhbrm.exe109⤵PID:5536
-
C:\Windows\SysWOW64\joxpdyla.exeC:\Windows\system32\joxpdyla.exe110⤵PID:5564
-
C:\Windows\SysWOW64\vlpfiths.exeC:\Windows\system32\vlpfiths.exe111⤵PID:5588
-
C:\Windows\SysWOW64\mogext.exeC:\Windows\system32\mogext.exe112⤵PID:5612
-
C:\Windows\SysWOW64\wktrqn.exeC:\Windows\system32\wktrqn.exe113⤵PID:5636
-
C:\Windows\SysWOW64\ecyggwpv.exeC:\Windows\system32\ecyggwpv.exe114⤵PID:5660
-
C:\Windows\SysWOW64\lweljmkq.exeC:\Windows\system32\lweljmkq.exe115⤵PID:5684
-
C:\Windows\SysWOW64\gqtfkffg.exeC:\Windows\system32\gqtfkffg.exe116⤵PID:5708
-
C:\Windows\SysWOW64\ibyiqqv.exeC:\Windows\system32\ibyiqqv.exe117⤵PID:5732
-
C:\Windows\SysWOW64\kgmbiq.exeC:\Windows\system32\kgmbiq.exe118⤵PID:5756
-
C:\Windows\SysWOW64\omkwiu.exeC:\Windows\system32\omkwiu.exe119⤵
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\ldfwbpwl.exeC:\Windows\system32\ldfwbpwl.exe120⤵PID:5808
-
C:\Windows\SysWOW64\gyerno.exeC:\Windows\system32\gyerno.exe121⤵PID:5832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-