Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 23:22
Behavioral task
behavioral1
Sample
0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe
-
Size
230KB
-
MD5
0258ce7319996dce855116d8de6c0d55
-
SHA1
40640e7372e10f9fd9a37d4b22681c3f8df66a43
-
SHA256
7203fec17df2b9239cd503ff359da5fbc72f0b157d49a1b8be1dfce1f30a7cb2
-
SHA512
758de1e13be854cf5e377d9f057abbffa229b7e49736446499ad60c7148dceae481e97ef01f1ef527121fbc5d6753ec05cceac7f59e010e7ca7441bfd3bcc94a
-
SSDEEP
3072:ThOmTsF93UYfwC6GIout0fmCiiiXAsACF486jFX8fkYtB6J6eUTV4qQzG:Tcm4FmowdHoSgWrXD486jFX88Y/eUBz
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2412-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-149-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/620-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/988-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/988-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/348-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-335-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/588-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/664-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-847-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-8042-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon behavioral1/memory/1976-8546-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon behavioral1/memory/1976-9051-0x0000000077550000-0x000000007764A000-memory.dmp family_blackmoon behavioral1/memory/1976-11566-0x0000000077550000-0x000000007764A000-memory.dmp family_blackmoon behavioral1/memory/1976-12562-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon behavioral1/memory/1976-17181-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon behavioral1/memory/1976-17738-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon behavioral1/memory/1976-22704-0x0000000077430000-0x000000007754F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3036 pjpvd.exe 2408 3rfrxxf.exe 2688 fxxrflr.exe 2244 jdvpv.exe 2708 rlxfxrf.exe 2868 hbntbn.exe 2736 vpdpp.exe 2764 7xxffxl.exe 2640 rlffxfx.exe 2800 dvpjp.exe 2668 ddppv.exe 3056 jjpjp.exe 1448 hnnhnh.exe 1680 jvddv.exe 2120 5xxlllx.exe 536 hhhnbb.exe 2500 9bbhnb.exe 600 xlfrlxf.exe 1636 7bnbth.exe 1316 jdvpv.exe 2948 7jvdj.exe 2916 rlflrrl.exe 2700 5tbnht.exe 3044 jpvdv.exe 1480 pjdvv.exe 620 xxxfffl.exe 1228 5nhhtb.exe 2336 vvvjp.exe 1544 fxrffrf.exe 2248 1fxxflx.exe 2516 nbntnb.exe 2484 5dvdj.exe 988 rrrlxlf.exe 2160 1hbnbb.exe 2260 9ntbhh.exe 2188 dvjdp.exe 3036 rfxffrx.exe 2564 rrlrrlr.exe 2508 bbbhth.exe 2528 bhbtth.exe 2888 vpjjv.exe 348 xrllxxr.exe 2744 5rlxffl.exe 2828 tbnnhh.exe 2868 thnntn.exe 2968 dvvdp.exe 2020 rlrxfrx.exe 2624 fxxrlrx.exe 2880 nhbthh.exe 2776 7bbnnb.exe 2620 1dpvj.exe 3060 fxfrflr.exe 3068 rflrflr.exe 684 xxrxffl.exe 576 btnbth.exe 1804 hbttnt.exe 376 vppjj.exe 588 vpjjp.exe 2000 rflffxx.exe 664 hhbnth.exe 1724 dvdvd.exe 2860 5vjpv.exe 892 fffxxlr.exe 1764 frffffl.exe -
resource yara_rule behavioral1/memory/2412-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000012029-5.dat upx behavioral1/memory/3036-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018d89-17.dat upx behavioral1/memory/2408-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018f94-26.dat upx behavioral1/memory/2408-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001904f-33.dat upx behavioral1/files/0x00060000000191fe-42.dat upx behavioral1/memory/2244-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019221-49.dat upx behavioral1/memory/2868-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001923a-57.dat upx behavioral1/memory/2736-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001a3ed-65.dat upx behavioral1/memory/2736-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f7-74.dat upx behavioral1/files/0x000500000001a405-81.dat upx behavioral1/memory/2800-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a412-90.dat upx behavioral1/memory/2668-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42f-98.dat upx behavioral1/memory/3056-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a444-108.dat upx behavioral1/memory/3056-106-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1448-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a44a-115.dat upx behavioral1/files/0x000500000001a45d-124.dat upx behavioral1/memory/1680-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a45e-131.dat upx behavioral1/memory/536-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a472-141.dat upx behavioral1/files/0x000500000001a47d-150.dat upx behavioral1/memory/600-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a481-158.dat upx behavioral1/files/0x000500000001a487-166.dat upx behavioral1/files/0x000500000001a489-173.dat upx behavioral1/files/0x000500000001a48a-183.dat upx behavioral1/memory/2700-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48d-191.dat upx behavioral1/memory/2700-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48f-199.dat upx behavioral1/memory/3044-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a494-208.dat upx behavioral1/memory/620-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018d6b-216.dat upx behavioral1/files/0x000500000001a498-223.dat upx behavioral1/memory/2336-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49c-231.dat upx behavioral1/memory/1544-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a0-239.dat upx behavioral1/files/0x000500000001a4a3-246.dat upx behavioral1/memory/2516-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a5-254.dat upx behavioral1/files/0x000500000001a4a7-261.dat upx behavioral1/memory/988-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/988-269-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 3036 2412 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 30 PID 2412 wrote to memory of 3036 2412 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 30 PID 2412 wrote to memory of 3036 2412 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 30 PID 2412 wrote to memory of 3036 2412 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 30 PID 3036 wrote to memory of 2408 3036 pjpvd.exe 31 PID 3036 wrote to memory of 2408 3036 pjpvd.exe 31 PID 3036 wrote to memory of 2408 3036 pjpvd.exe 31 PID 3036 wrote to memory of 2408 3036 pjpvd.exe 31 PID 2408 wrote to memory of 2688 2408 3rfrxxf.exe 32 PID 2408 wrote to memory of 2688 2408 3rfrxxf.exe 32 PID 2408 wrote to memory of 2688 2408 3rfrxxf.exe 32 PID 2408 wrote to memory of 2688 2408 3rfrxxf.exe 32 PID 2688 wrote to memory of 2244 2688 fxxrflr.exe 33 PID 2688 wrote to memory of 2244 2688 fxxrflr.exe 33 PID 2688 wrote to memory of 2244 2688 fxxrflr.exe 33 PID 2688 wrote to memory of 2244 2688 fxxrflr.exe 33 PID 2244 wrote to memory of 2708 2244 jdvpv.exe 34 PID 2244 wrote to memory of 2708 2244 jdvpv.exe 34 PID 2244 wrote to memory of 2708 2244 jdvpv.exe 34 PID 2244 wrote to memory of 2708 2244 jdvpv.exe 34 PID 2708 wrote to memory of 2868 2708 rlxfxrf.exe 35 PID 2708 wrote to memory of 2868 2708 rlxfxrf.exe 35 PID 2708 wrote to memory of 2868 2708 rlxfxrf.exe 35 PID 2708 wrote to memory of 2868 2708 rlxfxrf.exe 35 PID 2868 wrote to memory of 2736 2868 hbntbn.exe 36 PID 2868 wrote to memory of 2736 2868 hbntbn.exe 36 PID 2868 wrote to memory of 2736 2868 hbntbn.exe 36 PID 2868 wrote to memory of 2736 2868 hbntbn.exe 36 PID 2736 wrote to memory of 2764 2736 vpdpp.exe 37 PID 2736 wrote to memory of 2764 2736 vpdpp.exe 37 PID 2736 wrote to memory of 2764 2736 vpdpp.exe 37 PID 2736 wrote to memory of 2764 2736 vpdpp.exe 37 PID 2764 wrote to memory of 2640 2764 7xxffxl.exe 38 PID 2764 wrote to memory of 2640 2764 7xxffxl.exe 38 PID 2764 wrote to memory of 2640 2764 7xxffxl.exe 38 PID 2764 wrote to memory of 2640 2764 7xxffxl.exe 38 PID 2640 wrote to memory of 2800 2640 rlffxfx.exe 39 PID 2640 wrote to memory of 2800 2640 rlffxfx.exe 39 PID 2640 wrote to memory of 2800 2640 rlffxfx.exe 39 PID 2640 wrote to memory of 2800 2640 rlffxfx.exe 39 PID 2800 wrote to memory of 2668 2800 dvpjp.exe 40 PID 2800 wrote to memory of 2668 2800 dvpjp.exe 40 PID 2800 wrote to memory of 2668 2800 dvpjp.exe 40 PID 2800 wrote to memory of 2668 2800 dvpjp.exe 40 PID 2668 wrote to memory of 3056 2668 ddppv.exe 41 PID 2668 wrote to memory of 3056 2668 ddppv.exe 41 PID 2668 wrote to memory of 3056 2668 ddppv.exe 41 PID 2668 wrote to memory of 3056 2668 ddppv.exe 41 PID 3056 wrote to memory of 1448 3056 jjpjp.exe 42 PID 3056 wrote to memory of 1448 3056 jjpjp.exe 42 PID 3056 wrote to memory of 1448 3056 jjpjp.exe 42 PID 3056 wrote to memory of 1448 3056 jjpjp.exe 42 PID 1448 wrote to memory of 1680 1448 hnnhnh.exe 43 PID 1448 wrote to memory of 1680 1448 hnnhnh.exe 43 PID 1448 wrote to memory of 1680 1448 hnnhnh.exe 43 PID 1448 wrote to memory of 1680 1448 hnnhnh.exe 43 PID 1680 wrote to memory of 2120 1680 jvddv.exe 44 PID 1680 wrote to memory of 2120 1680 jvddv.exe 44 PID 1680 wrote to memory of 2120 1680 jvddv.exe 44 PID 1680 wrote to memory of 2120 1680 jvddv.exe 44 PID 2120 wrote to memory of 536 2120 5xxlllx.exe 45 PID 2120 wrote to memory of 536 2120 5xxlllx.exe 45 PID 2120 wrote to memory of 536 2120 5xxlllx.exe 45 PID 2120 wrote to memory of 536 2120 5xxlllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pjpvd.exec:\pjpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\3rfrxxf.exec:\3rfrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fxxrflr.exec:\fxxrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jdvpv.exec:\jdvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hbntbn.exec:\hbntbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vpdpp.exec:\vpdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7xxffxl.exec:\7xxffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlffxfx.exec:\rlffxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dvpjp.exec:\dvpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ddppv.exec:\ddppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jjpjp.exec:\jjpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hnnhnh.exec:\hnnhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\jvddv.exec:\jvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\5xxlllx.exec:\5xxlllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\hhhnbb.exec:\hhhnbb.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\9bbhnb.exec:\9bbhnb.exe18⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlfrlxf.exec:\xlfrlxf.exe19⤵
- Executes dropped EXE
PID:600 -
\??\c:\7bnbth.exec:\7bnbth.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdvpv.exec:\jdvpv.exe21⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7jvdj.exec:\7jvdj.exe22⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rlflrrl.exec:\rlflrrl.exe23⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5tbnht.exec:\5tbnht.exe24⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jpvdv.exec:\jpvdv.exe25⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pjdvv.exec:\pjdvv.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xxxfffl.exec:\xxxfffl.exe27⤵
- Executes dropped EXE
PID:620 -
\??\c:\5nhhtb.exec:\5nhhtb.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vvvjp.exec:\vvvjp.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fxrffrf.exec:\fxrffrf.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1fxxflx.exec:\1fxxflx.exe31⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nbntnb.exec:\nbntnb.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5dvdj.exec:\5dvdj.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rrrlxlf.exec:\rrrlxlf.exe34⤵
- Executes dropped EXE
PID:988 -
\??\c:\1hbnbb.exec:\1hbnbb.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9ntbhh.exec:\9ntbhh.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dvjdp.exec:\dvjdp.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rfxffrx.exec:\rfxffrx.exe38⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rrlrrlr.exec:\rrlrrlr.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbbhth.exec:\bbbhth.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bhbtth.exec:\bhbtth.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrllxxr.exec:\xrllxxr.exe43⤵
- Executes dropped EXE
PID:348 -
\??\c:\5rlxffl.exec:\5rlxffl.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbnnhh.exec:\tbnnhh.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\thnntn.exec:\thnntn.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvvdp.exec:\dvvdp.exe47⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlrxfrx.exec:\rlrxfrx.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxxrlrx.exec:\fxxrlrx.exe49⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhbthh.exec:\nhbthh.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7bbnnb.exec:\7bbnnb.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1dpvj.exec:\1dpvj.exe52⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxfrflr.exec:\fxfrflr.exe53⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rflrflr.exec:\rflrflr.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxrxffl.exec:\xxrxffl.exe55⤵
- Executes dropped EXE
PID:684 -
\??\c:\btnbth.exec:\btnbth.exe56⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbttnt.exec:\hbttnt.exe57⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vppjj.exec:\vppjj.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpjjp.exec:\vpjjp.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\rflffxx.exec:\rflffxx.exe60⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hhbnth.exec:\hhbnth.exe61⤵
- Executes dropped EXE
PID:664 -
\??\c:\dvdvd.exec:\dvdvd.exe62⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5vjpv.exec:\5vjpv.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fffxxlr.exec:\fffxxlr.exe64⤵
- Executes dropped EXE
PID:892 -
\??\c:\frffffl.exec:\frffffl.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\hnhnbh.exec:\hnhnbh.exe66⤵PID:2848
-
\??\c:\ddvpj.exec:\ddvpj.exe67⤵PID:2148
-
\??\c:\jdppp.exec:\jdppp.exe68⤵PID:2212
-
\??\c:\lfrfffl.exec:\lfrfffl.exe69⤵PID:2368
-
\??\c:\xlfxlrx.exec:\xlfxlrx.exe70⤵PID:2920
-
\??\c:\1btnbh.exec:\1btnbh.exe71⤵PID:2200
-
\??\c:\1dvdd.exec:\1dvdd.exe72⤵PID:2932
-
\??\c:\jvjpv.exec:\jvjpv.exe73⤵PID:796
-
\??\c:\xrxflrx.exec:\xrxflrx.exe74⤵PID:2576
-
\??\c:\5hnnhn.exec:\5hnnhn.exe75⤵PID:1700
-
\??\c:\5hbhtt.exec:\5hbhtt.exe76⤵PID:2232
-
\??\c:\vvddj.exec:\vvddj.exe77⤵PID:996
-
\??\c:\lflflfr.exec:\lflflfr.exe78⤵PID:1544
-
\??\c:\llllllf.exec:\llllllf.exe79⤵PID:2136
-
\??\c:\ttnntt.exec:\ttnntt.exe80⤵PID:1068
-
\??\c:\dvpvv.exec:\dvpvv.exe81⤵PID:2156
-
\??\c:\7vjdp.exec:\7vjdp.exe82⤵PID:2572
-
\??\c:\rrxllff.exec:\rrxllff.exe83⤵PID:548
-
\??\c:\tnbnnt.exec:\tnbnnt.exe84⤵PID:2036
-
\??\c:\thhhbn.exec:\thhhbn.exe85⤵PID:2392
-
\??\c:\dpvpd.exec:\dpvpd.exe86⤵PID:3024
-
\??\c:\pjvpd.exec:\pjvpd.exe87⤵PID:1576
-
\??\c:\rlxrxfr.exec:\rlxrxfr.exe88⤵PID:1032
-
\??\c:\7xlffff.exec:\7xlffff.exe89⤵PID:2388
-
\??\c:\nttnnb.exec:\nttnnb.exe90⤵PID:1936
-
\??\c:\5jjpj.exec:\5jjpj.exe91⤵PID:2792
-
\??\c:\vpdjj.exec:\vpdjj.exe92⤵PID:2696
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe93⤵PID:348
-
\??\c:\9lrlxfl.exec:\9lrlxfl.exe94⤵PID:2812
-
\??\c:\3nbhnb.exec:\3nbhnb.exe95⤵PID:2828
-
\??\c:\nnbntt.exec:\nnbntt.exe96⤵PID:2804
-
\??\c:\ddvvj.exec:\ddvvj.exe97⤵PID:2736
-
\??\c:\ddjdj.exec:\ddjdj.exe98⤵PID:3040
-
\??\c:\5xrrfrx.exec:\5xrrfrx.exe99⤵PID:2928
-
\??\c:\bbnntb.exec:\bbnntb.exe100⤵PID:2612
-
\??\c:\1nnbtb.exec:\1nnbtb.exe101⤵PID:2772
-
\??\c:\vvvvp.exec:\vvvvp.exe102⤵PID:1696
-
\??\c:\jvjpv.exec:\jvjpv.exe103⤵PID:2668
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe104⤵PID:2652
-
\??\c:\frrxffr.exec:\frrxffr.exe105⤵PID:1652
-
\??\c:\hnhnbb.exec:\hnhnbb.exe106⤵PID:1036
-
\??\c:\jpvdp.exec:\jpvdp.exe107⤵PID:1232
-
\??\c:\vppdd.exec:\vppdd.exe108⤵PID:864
-
\??\c:\5xfrxlr.exec:\5xfrxlr.exe109⤵PID:604
-
\??\c:\9rflxfr.exec:\9rflxfr.exe110⤵PID:588
-
\??\c:\1bhtbt.exec:\1bhtbt.exe111⤵PID:1076
-
\??\c:\ddpdp.exec:\ddpdp.exe112⤵PID:1928
-
\??\c:\pdpvj.exec:\pdpvj.exe113⤵PID:600
-
\??\c:\lxxfxlr.exec:\lxxfxlr.exe114⤵PID:2944
-
\??\c:\3tnntb.exec:\3tnntb.exe115⤵PID:2900
-
\??\c:\hbbnbb.exec:\hbbnbb.exe116⤵PID:1924
-
\??\c:\pdpvd.exec:\pdpvd.exe117⤵PID:1796
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe118⤵PID:2212
-
\??\c:\tbthtt.exec:\tbthtt.exe119⤵PID:2252
-
\??\c:\hhtnnt.exec:\hhtnnt.exe120⤵PID:2920
-
\??\c:\dpjjd.exec:\dpjjd.exe121⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-