Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 23:22
Behavioral task
behavioral1
Sample
0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe
-
Size
230KB
-
MD5
0258ce7319996dce855116d8de6c0d55
-
SHA1
40640e7372e10f9fd9a37d4b22681c3f8df66a43
-
SHA256
7203fec17df2b9239cd503ff359da5fbc72f0b157d49a1b8be1dfce1f30a7cb2
-
SHA512
758de1e13be854cf5e377d9f057abbffa229b7e49736446499ad60c7148dceae481e97ef01f1ef527121fbc5d6753ec05cceac7f59e010e7ca7441bfd3bcc94a
-
SSDEEP
3072:ThOmTsF93UYfwC6GIout0fmCiiiXAsACF486jFX8fkYtB6J6eUTV4qQzG:Tcm4FmowdHoSgWrXD486jFX88Y/eUBz
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1952-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-723-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3632 9hnhbh.exe 2708 vpddj.exe 4976 xllfxxl.exe 1028 jvvpd.exe 3260 llfrfxr.exe 3040 1hhhbb.exe 2364 jddvv.exe 4808 fxxxrxx.exe 1532 nnhbtt.exe 2280 9dddd.exe 892 nhttbb.exe 1880 jvvdd.exe 872 xxffxxl.exe 2300 hnnbnh.exe 4948 vjjvj.exe 1848 rlllfrr.exe 3284 bbttnt.exe 2504 llxrffr.exe 2952 nnnhhh.exe 4028 ffrfrlf.exe 764 3fffxff.exe 4852 3hthbn.exe 2736 ddpjd.exe 2208 3ffrfrl.exe 5096 5rfxxxx.exe 2512 bbnntb.exe 840 dpvvd.exe 1268 jdpjd.exe 1676 nhnnnb.exe 4532 7hhhhn.exe 228 jvpjd.exe 3148 rfxrxfx.exe 1376 hntttb.exe 1832 9dpjp.exe 396 3rlxxxr.exe 3988 lxxrrxx.exe 436 htnnnh.exe 3068 dvjdv.exe 1896 xxxxxfr.exe 3576 3frrlrl.exe 3608 nbnnhn.exe 4048 hbhhhh.exe 4364 pdjjp.exe 1816 7lfxrfl.exe 2052 rlxffll.exe 400 5bbbbb.exe 2444 pjpjj.exe 528 5pvpp.exe 3500 xrxrlll.exe 4832 hbnnhh.exe 3872 bbhntt.exe 2216 djppp.exe 3760 xxrxflx.exe 4060 ttthbb.exe 3640 tthhhn.exe 2640 jppjv.exe 2476 xfrxlrl.exe 3792 rxffffl.exe 1716 hhbbth.exe 4372 pjpvv.exe 1072 rrrlfxx.exe 1184 lflrrrr.exe 2528 bhtnhn.exe 2024 thbhhn.exe -
resource yara_rule behavioral2/memory/1952-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023465-3.dat upx behavioral2/memory/1952-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3632-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c3-9.dat upx behavioral2/memory/2708-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c4-12.dat upx behavioral2/files/0x00070000000234c5-18.dat upx behavioral2/memory/1028-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c6-22.dat upx behavioral2/files/0x00070000000234c7-27.dat upx behavioral2/memory/3040-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c8-33.dat upx behavioral2/memory/3040-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2364-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c9-39.dat upx behavioral2/files/0x00070000000234ca-43.dat upx behavioral2/memory/4808-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cb-48.dat upx behavioral2/memory/1532-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cc-53.dat upx behavioral2/files/0x00070000000234cd-57.dat upx behavioral2/memory/892-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ce-62.dat upx behavioral2/memory/1880-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/872-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cf-67.dat upx behavioral2/memory/2300-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d0-73.dat upx behavioral2/memory/4948-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d1-78.dat upx behavioral2/files/0x00070000000234d2-82.dat upx behavioral2/files/0x00070000000234d3-86.dat upx behavioral2/memory/3284-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d4-91.dat upx behavioral2/memory/2504-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000234b8-97.dat upx behavioral2/memory/2952-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d5-102.dat upx behavioral2/files/0x00070000000234d6-106.dat upx behavioral2/memory/764-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d7-111.dat upx behavioral2/memory/2736-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d8-116.dat upx behavioral2/memory/2736-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d9-121.dat upx behavioral2/memory/2208-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5096-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234da-127.dat upx behavioral2/memory/2512-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234db-133.dat upx behavioral2/files/0x00070000000234dd-136.dat upx behavioral2/memory/1268-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234de-142.dat upx behavioral2/files/0x00070000000234df-145.dat upx behavioral2/files/0x00070000000234e0-150.dat upx behavioral2/memory/228-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e1-156.dat upx behavioral2/memory/4532-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1832-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/396-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/436-170-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3632 1952 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 86 PID 1952 wrote to memory of 3632 1952 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 86 PID 1952 wrote to memory of 3632 1952 0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe 86 PID 3632 wrote to memory of 2708 3632 9hnhbh.exe 87 PID 3632 wrote to memory of 2708 3632 9hnhbh.exe 87 PID 3632 wrote to memory of 2708 3632 9hnhbh.exe 87 PID 2708 wrote to memory of 4976 2708 vpddj.exe 88 PID 2708 wrote to memory of 4976 2708 vpddj.exe 88 PID 2708 wrote to memory of 4976 2708 vpddj.exe 88 PID 4976 wrote to memory of 1028 4976 xllfxxl.exe 89 PID 4976 wrote to memory of 1028 4976 xllfxxl.exe 89 PID 4976 wrote to memory of 1028 4976 xllfxxl.exe 89 PID 1028 wrote to memory of 3260 1028 jvvpd.exe 90 PID 1028 wrote to memory of 3260 1028 jvvpd.exe 90 PID 1028 wrote to memory of 3260 1028 jvvpd.exe 90 PID 3260 wrote to memory of 3040 3260 llfrfxr.exe 91 PID 3260 wrote to memory of 3040 3260 llfrfxr.exe 91 PID 3260 wrote to memory of 3040 3260 llfrfxr.exe 91 PID 3040 wrote to memory of 2364 3040 1hhhbb.exe 92 PID 3040 wrote to memory of 2364 3040 1hhhbb.exe 92 PID 3040 wrote to memory of 2364 3040 1hhhbb.exe 92 PID 2364 wrote to memory of 4808 2364 jddvv.exe 93 PID 2364 wrote to memory of 4808 2364 jddvv.exe 93 PID 2364 wrote to memory of 4808 2364 jddvv.exe 93 PID 4808 wrote to memory of 1532 4808 fxxxrxx.exe 94 PID 4808 wrote to memory of 1532 4808 fxxxrxx.exe 94 PID 4808 wrote to memory of 1532 4808 fxxxrxx.exe 94 PID 1532 wrote to memory of 2280 1532 nnhbtt.exe 95 PID 1532 wrote to memory of 2280 1532 nnhbtt.exe 95 PID 1532 wrote to memory of 2280 1532 nnhbtt.exe 95 PID 2280 wrote to memory of 892 2280 9dddd.exe 96 PID 2280 wrote to memory of 892 2280 9dddd.exe 96 PID 2280 wrote to memory of 892 2280 9dddd.exe 96 PID 892 wrote to memory of 1880 892 nhttbb.exe 97 PID 892 wrote to memory of 1880 892 nhttbb.exe 97 PID 892 wrote to memory of 1880 892 nhttbb.exe 97 PID 1880 wrote to memory of 872 1880 jvvdd.exe 98 PID 1880 wrote to memory of 872 1880 jvvdd.exe 98 PID 1880 wrote to memory of 872 1880 jvvdd.exe 98 PID 872 wrote to memory of 2300 872 xxffxxl.exe 99 PID 872 wrote to memory of 2300 872 xxffxxl.exe 99 PID 872 wrote to memory of 2300 872 xxffxxl.exe 99 PID 2300 wrote to memory of 4948 2300 hnnbnh.exe 100 PID 2300 wrote to memory of 4948 2300 hnnbnh.exe 100 PID 2300 wrote to memory of 4948 2300 hnnbnh.exe 100 PID 4948 wrote to memory of 1848 4948 vjjvj.exe 101 PID 4948 wrote to memory of 1848 4948 vjjvj.exe 101 PID 4948 wrote to memory of 1848 4948 vjjvj.exe 101 PID 1848 wrote to memory of 3284 1848 rlllfrr.exe 102 PID 1848 wrote to memory of 3284 1848 rlllfrr.exe 102 PID 1848 wrote to memory of 3284 1848 rlllfrr.exe 102 PID 3284 wrote to memory of 2504 3284 bbttnt.exe 104 PID 3284 wrote to memory of 2504 3284 bbttnt.exe 104 PID 3284 wrote to memory of 2504 3284 bbttnt.exe 104 PID 2504 wrote to memory of 2952 2504 llxrffr.exe 105 PID 2504 wrote to memory of 2952 2504 llxrffr.exe 105 PID 2504 wrote to memory of 2952 2504 llxrffr.exe 105 PID 2952 wrote to memory of 4028 2952 nnnhhh.exe 106 PID 2952 wrote to memory of 4028 2952 nnnhhh.exe 106 PID 2952 wrote to memory of 4028 2952 nnnhhh.exe 106 PID 4028 wrote to memory of 764 4028 ffrfrlf.exe 108 PID 4028 wrote to memory of 764 4028 ffrfrlf.exe 108 PID 4028 wrote to memory of 764 4028 ffrfrlf.exe 108 PID 764 wrote to memory of 4852 764 3fffxff.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0258ce7319996dce855116d8de6c0d55_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\9hnhbh.exec:\9hnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\vpddj.exec:\vpddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xllfxxl.exec:\xllfxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jvvpd.exec:\jvvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\llfrfxr.exec:\llfrfxr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\1hhhbb.exec:\1hhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\jddvv.exec:\jddvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\nnhbtt.exec:\nnhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\9dddd.exec:\9dddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nhttbb.exec:\nhttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\jvvdd.exec:\jvvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\xxffxxl.exec:\xxffxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\hnnbnh.exec:\hnnbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vjjvj.exec:\vjjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\rlllfrr.exec:\rlllfrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\bbttnt.exec:\bbttnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\llxrffr.exec:\llxrffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nnnhhh.exec:\nnnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ffrfrlf.exec:\ffrfrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\3fffxff.exec:\3fffxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\3hthbn.exec:\3hthbn.exe23⤵
- Executes dropped EXE
PID:4852 -
\??\c:\ddpjd.exec:\ddpjd.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3ffrfrl.exec:\3ffrfrl.exe25⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5rfxxxx.exec:\5rfxxxx.exe26⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bbnntb.exec:\bbnntb.exe27⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dpvvd.exec:\dpvvd.exe28⤵
- Executes dropped EXE
PID:840 -
\??\c:\jdpjd.exec:\jdpjd.exe29⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nhnnnb.exec:\nhnnnb.exe30⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7hhhhn.exec:\7hhhhn.exe31⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jvpjd.exec:\jvpjd.exe32⤵
- Executes dropped EXE
PID:228 -
\??\c:\rfxrxfx.exec:\rfxrxfx.exe33⤵
- Executes dropped EXE
PID:3148 -
\??\c:\hntttb.exec:\hntttb.exe34⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9dpjp.exec:\9dpjp.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3rlxxxr.exec:\3rlxxxr.exe36⤵
- Executes dropped EXE
PID:396 -
\??\c:\lxxrrxx.exec:\lxxrrxx.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3988 -
\??\c:\htnnnh.exec:\htnnnh.exe38⤵
- Executes dropped EXE
PID:436 -
\??\c:\dvjdv.exec:\dvjdv.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe40⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3frrlrl.exec:\3frrlrl.exe41⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nbnnhn.exec:\nbnnhn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3608 -
\??\c:\hbhhhh.exec:\hbhhhh.exe43⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pdjjp.exec:\pdjjp.exe44⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7lfxrfl.exec:\7lfxrfl.exe45⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rlxffll.exec:\rlxffll.exe46⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5bbbbb.exec:\5bbbbb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400 -
\??\c:\pjpjj.exec:\pjpjj.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5pvpp.exec:\5pvpp.exe49⤵
- Executes dropped EXE
PID:528 -
\??\c:\xrxrlll.exec:\xrxrlll.exe50⤵
- Executes dropped EXE
PID:3500 -
\??\c:\hbnnhh.exec:\hbnnhh.exe51⤵
- Executes dropped EXE
PID:4832 -
\??\c:\bbhntt.exec:\bbhntt.exe52⤵
- Executes dropped EXE
PID:3872 -
\??\c:\djppp.exec:\djppp.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xxrxflx.exec:\xxrxflx.exe54⤵
- Executes dropped EXE
PID:3760 -
\??\c:\ttthbb.exec:\ttthbb.exe55⤵
- Executes dropped EXE
PID:4060 -
\??\c:\tthhhn.exec:\tthhhn.exe56⤵
- Executes dropped EXE
PID:3640 -
\??\c:\jppjv.exec:\jppjv.exe57⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xfrxlrl.exec:\xfrxlrl.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rxffffl.exec:\rxffffl.exe59⤵
- Executes dropped EXE
PID:3792 -
\??\c:\hhbbth.exec:\hhbbth.exe60⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjpvv.exec:\pjpvv.exe61⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe62⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lflrrrr.exec:\lflrrrr.exe63⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bhtnhn.exec:\bhtnhn.exe64⤵
- Executes dropped EXE
PID:2528 -
\??\c:\thbhhn.exec:\thbhhn.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jpjpd.exec:\jpjpd.exe66⤵PID:4376
-
\??\c:\fffffrr.exec:\fffffrr.exe67⤵PID:532
-
\??\c:\xffffll.exec:\xffffll.exe68⤵PID:1848
-
\??\c:\3bhhhb.exec:\3bhhhb.exe69⤵PID:760
-
\??\c:\jvjpj.exec:\jvjpj.exe70⤵PID:3892
-
\??\c:\xxfxffx.exec:\xxfxffx.exe71⤵PID:3516
-
\??\c:\3rffxrl.exec:\3rffxrl.exe72⤵PID:1524
-
\??\c:\thhbnn.exec:\thhbnn.exe73⤵PID:2372
-
\??\c:\dppjj.exec:\dppjj.exe74⤵PID:764
-
\??\c:\jpvvv.exec:\jpvvv.exe75⤵PID:5056
-
\??\c:\flxxxxr.exec:\flxxxxr.exe76⤵PID:1812
-
\??\c:\hnhhtt.exec:\hnhhtt.exe77⤵PID:2436
-
\??\c:\vjvpj.exec:\vjvpj.exe78⤵PID:2208
-
\??\c:\ddjpv.exec:\ddjpv.exe79⤵PID:672
-
\??\c:\xxllrxx.exec:\xxllrxx.exe80⤵PID:5096
-
\??\c:\xrxlxlx.exec:\xrxlxlx.exe81⤵PID:4008
-
\??\c:\tntnnn.exec:\tntnnn.exe82⤵PID:840
-
\??\c:\dvvdd.exec:\dvvdd.exe83⤵PID:4452
-
\??\c:\fxlllff.exec:\fxlllff.exe84⤵PID:3292
-
\??\c:\fllrrrx.exec:\fllrrrx.exe85⤵PID:3740
-
\??\c:\bbbhnh.exec:\bbbhnh.exe86⤵PID:232
-
\??\c:\vdjjv.exec:\vdjjv.exe87⤵PID:2572
-
\??\c:\rxflffx.exec:\rxflffx.exe88⤵PID:4532
-
\??\c:\tnhhhn.exec:\tnhhhn.exe89⤵PID:1664
-
\??\c:\5btttb.exec:\5btttb.exe90⤵PID:784
-
\??\c:\vddpj.exec:\vddpj.exe91⤵PID:3092
-
\??\c:\fxffrrl.exec:\fxffrrl.exe92⤵PID:3184
-
\??\c:\hntbnh.exec:\hntbnh.exe93⤵PID:4804
-
\??\c:\ppvpj.exec:\ppvpj.exe94⤵PID:3848
-
\??\c:\xlllrxf.exec:\xlllrxf.exe95⤵PID:3988
-
\??\c:\1lrllrr.exec:\1lrllrr.exe96⤵PID:1628
-
\??\c:\nnbhhn.exec:\nnbhhn.exe97⤵PID:3068
-
\??\c:\jpjpd.exec:\jpjpd.exe98⤵PID:4716
-
\??\c:\xrfrrlf.exec:\xrfrrlf.exe99⤵PID:1312
-
\??\c:\xrxxrll.exec:\xrxxrll.exe100⤵PID:372
-
\??\c:\5pjvv.exec:\5pjvv.exe101⤵PID:1624
-
\??\c:\pdpjj.exec:\pdpjj.exe102⤵PID:4412
-
\??\c:\nnbhnb.exec:\nnbhnb.exe103⤵PID:4932
-
\??\c:\vvjjv.exec:\vvjjv.exe104⤵PID:400
-
\??\c:\xrrlrxf.exec:\xrrlrxf.exe105⤵PID:2444
-
\??\c:\9rrrfll.exec:\9rrrfll.exe106⤵PID:528
-
\??\c:\hnhthh.exec:\hnhthh.exe107⤵PID:4900
-
\??\c:\1jjpp.exec:\1jjpp.exe108⤵PID:3500
-
\??\c:\dvppd.exec:\dvppd.exe109⤵PID:3624
-
\??\c:\xrflrfl.exec:\xrflrfl.exe110⤵PID:3660
-
\??\c:\hhhhhh.exec:\hhhhhh.exe111⤵PID:2940
-
\??\c:\3vvpj.exec:\3vvpj.exe112⤵PID:2652
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe113⤵PID:4244
-
\??\c:\lxfxrxf.exec:\lxfxrxf.exe114⤵PID:3024
-
\??\c:\hnnhbt.exec:\hnnhbt.exe115⤵PID:216
-
\??\c:\pjjpv.exec:\pjjpv.exe116⤵PID:2008
-
\??\c:\dvpdp.exec:\dvpdp.exe117⤵PID:920
-
\??\c:\1xxlfxl.exec:\1xxlfxl.exe118⤵PID:1880
-
\??\c:\bbbnhh.exec:\bbbnhh.exe119⤵PID:4768
-
\??\c:\jvjdp.exec:\jvjdp.exe120⤵
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:312
-
\??\c:\7xlrllr.exec:\7xlrllr.exe122⤵PID:3732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-