Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe
-
Size
209KB
-
MD5
0230b81d5f788e582797fd54bea56470
-
SHA1
98fd12512f29fcf4a3a8a78b0f013699cdb5c925
-
SHA256
81e43925032313743f0d0f85c6b81b10f79376bd106b8de655e3e640709cdad6
-
SHA512
e148db08609779a2936cb804546765938cd532c42822ca943c8a030c30351e5f9291bc26c272d90e11c80c145f8c37bdee22c326248e688b8b75f854deb8afba
-
SSDEEP
3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5VaQv2:Ecm7ImGddXyt38TU5u
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2392-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-275-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2940-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-412-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-699-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2700-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-964-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-919-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-452-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 dnfnxjr.exe 2160 jhxbbt.exe 2696 dldbxx.exe 2392 jvrxtn.exe 764 vxnhbr.exe 2240 rlxrtvt.exe 2852 vxpxjt.exe 2768 nvnxn.exe 2620 xfptv.exe 3040 dvbvf.exe 1956 nfrlfxl.exe 1996 hjprb.exe 436 nrrxbj.exe 1720 frxhv.exe 528 jrhdlx.exe 1200 xffltn.exe 556 bfpxp.exe 1740 jlpdjx.exe 952 ptnhtvl.exe 2936 rvjvv.exe 2332 tvfvnt.exe 320 hfxvnv.exe 2256 dhnnjv.exe 2248 nbtlr.exe 1588 fnrxj.exe 308 pdhvnh.exe 1328 phjvv.exe 2300 nvvldr.exe 2536 vhpnnpn.exe 1512 nvnfjb.exe 2940 nnxnbvb.exe 1604 tnxdfn.exe 876 tfdpb.exe 2548 nvphttf.exe 3064 nxlnp.exe 1596 bpvbbxt.exe 2796 rxfpfrp.exe 1796 tfvtr.exe 2204 drvvlv.exe 2952 vhjphn.exe 2876 vjxjj.exe 2912 prfdb.exe 2932 njlfl.exe 2852 lpdxpt.exe 2656 jpjpbtr.exe 2772 jjjrpf.exe 3048 vndjp.exe 2000 rpvptn.exe 2892 hhnvn.exe 2492 jnxrvv.exe 2516 fjjjhrd.exe 2872 jtplbj.exe 1620 lltxr.exe 2296 xpxbpl.exe 1772 nnfdl.exe 1744 vtbrxh.exe 1636 tvvfb.exe 1936 dltvr.exe 1868 htvhdj.exe 1492 jrnpvp.exe 1340 hndhndl.exe 2256 vlltln.exe 412 hfvvndn.exe 236 bpnxfpn.exe -
resource yara_rule behavioral1/memory/2696-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-1039-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1011-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-998-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-973-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-1052-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtbrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvnxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvrvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjrjnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvphfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfxpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhldjjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhpllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxdjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfxlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfnxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhdlhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brntvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxtbfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdxpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrhvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfbfld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpttnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnrtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdrdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnxrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpxdjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttftnpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbpbft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnlnxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htffhlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddprjdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfnpdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfdlbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbtbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3052 2056 0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe 540 PID 2056 wrote to memory of 3052 2056 0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe 540 PID 2056 wrote to memory of 3052 2056 0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe 540 PID 2056 wrote to memory of 3052 2056 0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe 540 PID 3052 wrote to memory of 2160 3052 dnfnxjr.exe 680 PID 3052 wrote to memory of 2160 3052 dnfnxjr.exe 680 PID 3052 wrote to memory of 2160 3052 dnfnxjr.exe 680 PID 3052 wrote to memory of 2160 3052 dnfnxjr.exe 680 PID 2160 wrote to memory of 2696 2160 jhxbbt.exe 520 PID 2160 wrote to memory of 2696 2160 jhxbbt.exe 520 PID 2160 wrote to memory of 2696 2160 jhxbbt.exe 520 PID 2160 wrote to memory of 2696 2160 jhxbbt.exe 520 PID 2696 wrote to memory of 2392 2696 dldbxx.exe 32 PID 2696 wrote to memory of 2392 2696 dldbxx.exe 32 PID 2696 wrote to memory of 2392 2696 dldbxx.exe 32 PID 2696 wrote to memory of 2392 2696 dldbxx.exe 32 PID 2392 wrote to memory of 764 2392 jvrxtn.exe 33 PID 2392 wrote to memory of 764 2392 jvrxtn.exe 33 PID 2392 wrote to memory of 764 2392 jvrxtn.exe 33 PID 2392 wrote to memory of 764 2392 jvrxtn.exe 33 PID 764 wrote to memory of 2240 764 vxnhbr.exe 528 PID 764 wrote to memory of 2240 764 vxnhbr.exe 528 PID 764 wrote to memory of 2240 764 vxnhbr.exe 528 PID 764 wrote to memory of 2240 764 vxnhbr.exe 528 PID 2240 wrote to memory of 2852 2240 rlxrtvt.exe 576 PID 2240 wrote to memory of 2852 2240 rlxrtvt.exe 576 PID 2240 wrote to memory of 2852 2240 rlxrtvt.exe 576 PID 2240 wrote to memory of 2852 2240 rlxrtvt.exe 576 PID 2852 wrote to memory of 2768 2852 vxpxjt.exe 36 PID 2852 wrote to memory of 2768 2852 vxpxjt.exe 36 PID 2852 wrote to memory of 2768 2852 vxpxjt.exe 36 PID 2852 wrote to memory of 2768 2852 vxpxjt.exe 36 PID 2768 wrote to memory of 2620 2768 nvnxn.exe 486 PID 2768 wrote to memory of 2620 2768 nvnxn.exe 486 PID 2768 wrote to memory of 2620 2768 nvnxn.exe 486 PID 2768 wrote to memory of 2620 2768 nvnxn.exe 486 PID 2620 wrote to memory of 3040 2620 xfptv.exe 668 PID 2620 wrote to memory of 3040 2620 xfptv.exe 668 PID 2620 wrote to memory of 3040 2620 xfptv.exe 668 PID 2620 wrote to memory of 3040 2620 xfptv.exe 668 PID 3040 wrote to memory of 1956 3040 dvbvf.exe 765 PID 3040 wrote to memory of 1956 3040 dvbvf.exe 765 PID 3040 wrote to memory of 1956 3040 dvbvf.exe 765 PID 3040 wrote to memory of 1956 3040 dvbvf.exe 765 PID 1956 wrote to memory of 1996 1956 nfrlfxl.exe 395 PID 1956 wrote to memory of 1996 1956 nfrlfxl.exe 395 PID 1956 wrote to memory of 1996 1956 nfrlfxl.exe 395 PID 1956 wrote to memory of 1996 1956 nfrlfxl.exe 395 PID 1996 wrote to memory of 436 1996 hjprb.exe 440 PID 1996 wrote to memory of 436 1996 hjprb.exe 440 PID 1996 wrote to memory of 436 1996 hjprb.exe 440 PID 1996 wrote to memory of 436 1996 hjprb.exe 440 PID 436 wrote to memory of 1720 436 nrrxbj.exe 444 PID 436 wrote to memory of 1720 436 nrrxbj.exe 444 PID 436 wrote to memory of 1720 436 nrrxbj.exe 444 PID 436 wrote to memory of 1720 436 nrrxbj.exe 444 PID 1720 wrote to memory of 528 1720 frxhv.exe 491 PID 1720 wrote to memory of 528 1720 frxhv.exe 491 PID 1720 wrote to memory of 528 1720 frxhv.exe 491 PID 1720 wrote to memory of 528 1720 frxhv.exe 491 PID 528 wrote to memory of 1200 528 jrhdlx.exe 775 PID 528 wrote to memory of 1200 528 jrhdlx.exe 775 PID 528 wrote to memory of 1200 528 jrhdlx.exe 775 PID 528 wrote to memory of 1200 528 jrhdlx.exe 775
Processes
-
C:\Users\Admin\AppData\Local\Temp\0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0230b81d5f788e582797fd54bea56470_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dnfnxjr.exec:\dnfnxjr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jhxbbt.exec:\jhxbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dldbxx.exec:\dldbxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvrxtn.exec:\jvrxtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\vxnhbr.exec:\vxnhbr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rlxrtvt.exec:\rlxrtvt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vxpxjt.exec:\vxpxjt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nvnxn.exec:\nvnxn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xfptv.exec:\xfptv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvbvf.exec:\dvbvf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nfrlfxl.exec:\nfrlfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\hjprb.exec:\hjprb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\nrrxbj.exec:\nrrxbj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\frxhv.exec:\frxhv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jrhdlx.exec:\jrhdlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\xffltn.exec:\xffltn.exe17⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bfpxp.exec:\bfpxp.exe18⤵
- Executes dropped EXE
PID:556 -
\??\c:\jlpdjx.exec:\jlpdjx.exe19⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ptnhtvl.exec:\ptnhtvl.exe20⤵
- Executes dropped EXE
PID:952 -
\??\c:\rvjvv.exec:\rvjvv.exe21⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tvfvnt.exec:\tvfvnt.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hfxvnv.exec:\hfxvnv.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\dhnnjv.exec:\dhnnjv.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbtlr.exec:\nbtlr.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fnrxj.exec:\fnrxj.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pdhvnh.exec:\pdhvnh.exe27⤵
- Executes dropped EXE
PID:308 -
\??\c:\phjvv.exec:\phjvv.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nvvldr.exec:\nvvldr.exe29⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vhpnnpn.exec:\vhpnnpn.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nvnfjb.exec:\nvnfjb.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nnxnbvb.exec:\nnxnbvb.exe32⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnxdfn.exec:\tnxdfn.exe33⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tfdpb.exec:\tfdpb.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\nvphttf.exec:\nvphttf.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nxlnp.exec:\nxlnp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\bpvbbxt.exec:\bpvbbxt.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rxfpfrp.exec:\rxfpfrp.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tfvtr.exec:\tfvtr.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\drvvlv.exec:\drvvlv.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vhjphn.exec:\vhjphn.exe41⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjxjj.exec:\vjxjj.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\prfdb.exec:\prfdb.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\njlfl.exec:\njlfl.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lpdxpt.exec:\lpdxpt.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\jpjpbtr.exec:\jpjpbtr.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jjjrpf.exec:\jjjrpf.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vndjp.exec:\vndjp.exe48⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rpvptn.exec:\rpvptn.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hhnvn.exec:\hhnvn.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jnxrvv.exec:\jnxrvv.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\fjjjhrd.exec:\fjjjhrd.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jtplbj.exec:\jtplbj.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lltxr.exec:\lltxr.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xpxbpl.exec:\xpxbpl.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nnfdl.exec:\nnfdl.exe56⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vtbrxh.exec:\vtbrxh.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\tvvfb.exec:\tvvfb.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dltvr.exec:\dltvr.exe59⤵
- Executes dropped EXE
PID:1936 -
\??\c:\htvhdj.exec:\htvhdj.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jrnpvp.exec:\jrnpvp.exe61⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hndhndl.exec:\hndhndl.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vlltln.exec:\vlltln.exe63⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hfvvndn.exec:\hfvvndn.exe64⤵
- Executes dropped EXE
PID:412 -
\??\c:\bpnxfpn.exec:\bpnxfpn.exe65⤵
- Executes dropped EXE
PID:236 -
\??\c:\vbjtx.exec:\vbjtx.exe66⤵PID:2412
-
\??\c:\rjbdvbj.exec:\rjbdvbj.exe67⤵PID:308
-
\??\c:\vprfdlx.exec:\vprfdlx.exe68⤵PID:2928
-
\??\c:\tbdhtf.exec:\tbdhtf.exe69⤵PID:2984
-
\??\c:\hjvnbnf.exec:\hjvnbnf.exe70⤵PID:924
-
\??\c:\nxpdh.exec:\nxpdh.exe71⤵PID:2536
-
\??\c:\ltlpr.exec:\ltlpr.exe72⤵PID:2268
-
\??\c:\nnxfjp.exec:\nnxfjp.exe73⤵PID:2052
-
\??\c:\jbnrd.exec:\jbnrd.exe74⤵PID:756
-
\??\c:\tjrfp.exec:\tjrfp.exe75⤵PID:1604
-
\??\c:\jpxftrd.exec:\jpxftrd.exe76⤵PID:1484
-
\??\c:\fhtnndt.exec:\fhtnndt.exe77⤵PID:3024
-
\??\c:\tprrjjr.exec:\tprrjjr.exe78⤵PID:2560
-
\??\c:\nhhjvdn.exec:\nhhjvdn.exe79⤵PID:1600
-
\??\c:\hxbjnr.exec:\hxbjnr.exe80⤵PID:1696
-
\??\c:\vfbbn.exec:\vfbbn.exe81⤵PID:3028
-
\??\c:\tvtrrvn.exec:\tvtrrvn.exe82⤵PID:1796
-
\??\c:\hnhbbbb.exec:\hnhbbbb.exe83⤵PID:888
-
\??\c:\lvhnb.exec:\lvhnb.exe84⤵PID:2456
-
\??\c:\njbdd.exec:\njbdd.exe85⤵PID:2876
-
\??\c:\pnpblp.exec:\pnpblp.exe86⤵PID:2916
-
\??\c:\vvflx.exec:\vvflx.exe87⤵PID:2920
-
\??\c:\fpvpv.exec:\fpvpv.exe88⤵PID:564
-
\??\c:\xfbnrp.exec:\xfbnrp.exe89⤵PID:2636
-
\??\c:\rtbbbhl.exec:\rtbbbhl.exe90⤵PID:2584
-
\??\c:\vjrjdv.exec:\vjrjdv.exe91⤵PID:824
-
\??\c:\brftn.exec:\brftn.exe92⤵PID:1248
-
\??\c:\bhnjrbr.exec:\bhnjrbr.exe93⤵PID:304
-
\??\c:\jvxlt.exec:\jvxlt.exe94⤵PID:2892
-
\??\c:\hhxhx.exec:\hhxhx.exe95⤵
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\xbxdxpr.exec:\xbxdxpr.exe96⤵PID:1264
-
\??\c:\thjhrb.exec:\thjhrb.exe97⤵PID:2872
-
\??\c:\njlxjj.exec:\njlxjj.exe98⤵PID:1320
-
\??\c:\xhbfftf.exec:\xhbfftf.exe99⤵PID:2860
-
\??\c:\rjfltdt.exec:\rjfltdt.exe100⤵PID:2580
-
\??\c:\lrbpf.exec:\lrbpf.exe101⤵PID:1740
-
\??\c:\dbxll.exec:\dbxll.exe102⤵PID:2428
-
\??\c:\vxnprv.exec:\vxnprv.exe103⤵PID:1636
-
\??\c:\pxffl.exec:\pxffl.exe104⤵PID:2700
-
\??\c:\nnbhf.exec:\nnbhf.exe105⤵PID:320
-
\??\c:\dxpfb.exec:\dxpfb.exe106⤵PID:2252
-
\??\c:\xjjrtpp.exec:\xjjrtpp.exe107⤵PID:2496
-
\??\c:\vnlxxb.exec:\vnlxxb.exe108⤵PID:2504
-
\??\c:\rvlbh.exec:\rvlbh.exe109⤵PID:2976
-
\??\c:\pxvhhx.exec:\pxvhhx.exe110⤵PID:1376
-
\??\c:\rbfrx.exec:\rbfrx.exe111⤵PID:1664
-
\??\c:\htffhlt.exec:\htffhlt.exe112⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\fvtthpj.exec:\fvtthpj.exe113⤵PID:920
-
\??\c:\jxjxbht.exec:\jxjxbht.exe114⤵PID:536
-
\??\c:\dnvhfrv.exec:\dnvhfrv.exe115⤵PID:1172
-
\??\c:\lrdrt.exec:\lrdrt.exe116⤵PID:1512
-
\??\c:\fndrxp.exec:\fndrxp.exe117⤵PID:1532
-
\??\c:\jvvnxr.exec:\jvvnxr.exe118⤵
- System Location Discovery: System Language Discovery
PID:572 -
\??\c:\bnvrvdv.exec:\bnvrvdv.exe119⤵
- System Location Discovery: System Language Discovery
PID:612 -
\??\c:\jxnfp.exec:\jxnfp.exe120⤵PID:1504
-
\??\c:\xtvjpph.exec:\xtvjpph.exe121⤵PID:2784
-
\??\c:\vbdbt.exec:\vbdbt.exe122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-