Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe
-
Size
337KB
-
MD5
028c427d409a3ac2182e6fe0e0c1f48b
-
SHA1
6c4c4eee217a02db28969604f574654d64fe82bd
-
SHA256
1580324e54887ef6f3b575948b976f642385cddc88efff044239f23165214f81
-
SHA512
25bd779fa6de71e03d23a353e8098242583cecade8ca0b9dffcb4eacea63bda24b1a55f0c6ea1fc35cc08d1969fe1a17ed871b6b4e1d8065420301267c99d960
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486j8ZAc:Pcm7ImGddXtWrXD486jHc
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2016-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-766-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-1097-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-916-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1304-759-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-647-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-464-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1916-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/328-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-185-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1296-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 jdppv.exe 2016 llllxlf.exe 2176 1hhhbh.exe 3052 7btbnh.exe 2712 vvvdv.exe 2828 5xfrfrl.exe 2612 hbtbnn.exe 2512 vdpvv.exe 2788 fffrflf.exe 2608 nhhtht.exe 2728 pdppp.exe 3056 xffrfxr.exe 564 nhbhth.exe 544 djjdp.exe 2036 3ffrrlr.exe 1296 1bttnt.exe 2360 3vjvp.exe 1040 vpjdv.exe 1912 nhbnnb.exe 2872 7ppdp.exe 1968 1lffxxr.exe 2208 tttnnb.exe 1264 5vjvp.exe 2404 pvvpp.exe 1284 3fxfrxr.exe 896 5ttntb.exe 1472 jdvdj.exe 1644 lrlxlfx.exe 2568 hbbhbb.exe 984 jddjd.exe 328 djddv.exe 988 xxxfxfr.exe 2416 ttnnbn.exe 1680 pppjd.exe 2220 lxflxlf.exe 2264 llfrlxr.exe 2488 bbbntb.exe 2836 vvpdd.exe 2832 1xffrlf.exe 2848 fxxfrrx.exe 2256 hnthbh.exe 2616 btttnt.exe 2804 djvjv.exe 3024 fxrfxlx.exe 3068 fxrxrxr.exe 3056 nnnhth.exe 1368 djvjj.exe 1560 9pdpp.exe 2036 lrxflfl.exe 1916 rrxrfxf.exe 2668 nhhnbh.exe 1172 hhhbnh.exe 2672 5ddpd.exe 1908 lllxlrf.exe 800 bnhhhb.exe 1996 pjpjp.exe 2952 dppvd.exe 1464 rxrrrll.exe 2904 rlflfll.exe 944 tnbtbn.exe 1528 hhbhth.exe 1304 vpjvp.exe 2928 jjvjd.exe 2812 xrxfrlf.exe -
resource yara_rule behavioral1/memory/2016-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-569-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-766-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-779-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-860-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-897-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-1030-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-1135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-1264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-1405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-1332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-1289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-1239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-1214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-1110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-1097-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-969-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-962-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-919-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-910-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-799-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-792-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-759-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/452-728-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-685-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-666-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-647-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-640-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-619-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-535-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-528-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-144-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2552 2528 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2552 2528 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2552 2528 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 30 PID 2528 wrote to memory of 2552 2528 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 30 PID 2552 wrote to memory of 2016 2552 jdppv.exe 31 PID 2552 wrote to memory of 2016 2552 jdppv.exe 31 PID 2552 wrote to memory of 2016 2552 jdppv.exe 31 PID 2552 wrote to memory of 2016 2552 jdppv.exe 31 PID 2016 wrote to memory of 2176 2016 llllxlf.exe 32 PID 2016 wrote to memory of 2176 2016 llllxlf.exe 32 PID 2016 wrote to memory of 2176 2016 llllxlf.exe 32 PID 2016 wrote to memory of 2176 2016 llllxlf.exe 32 PID 2176 wrote to memory of 3052 2176 1hhhbh.exe 33 PID 2176 wrote to memory of 3052 2176 1hhhbh.exe 33 PID 2176 wrote to memory of 3052 2176 1hhhbh.exe 33 PID 2176 wrote to memory of 3052 2176 1hhhbh.exe 33 PID 3052 wrote to memory of 2712 3052 7btbnh.exe 34 PID 3052 wrote to memory of 2712 3052 7btbnh.exe 34 PID 3052 wrote to memory of 2712 3052 7btbnh.exe 34 PID 3052 wrote to memory of 2712 3052 7btbnh.exe 34 PID 2712 wrote to memory of 2828 2712 vvvdv.exe 35 PID 2712 wrote to memory of 2828 2712 vvvdv.exe 35 PID 2712 wrote to memory of 2828 2712 vvvdv.exe 35 PID 2712 wrote to memory of 2828 2712 vvvdv.exe 35 PID 2828 wrote to memory of 2612 2828 5xfrfrl.exe 36 PID 2828 wrote to memory of 2612 2828 5xfrfrl.exe 36 PID 2828 wrote to memory of 2612 2828 5xfrfrl.exe 36 PID 2828 wrote to memory of 2612 2828 5xfrfrl.exe 36 PID 2612 wrote to memory of 2512 2612 hbtbnn.exe 37 PID 2612 wrote to memory of 2512 2612 hbtbnn.exe 37 PID 2612 wrote to memory of 2512 2612 hbtbnn.exe 37 PID 2612 wrote to memory of 2512 2612 hbtbnn.exe 37 PID 2512 wrote to memory of 2788 2512 vdpvv.exe 38 PID 2512 wrote to memory of 2788 2512 vdpvv.exe 38 PID 2512 wrote to memory of 2788 2512 vdpvv.exe 38 PID 2512 wrote to memory of 2788 2512 vdpvv.exe 38 PID 2788 wrote to memory of 2608 2788 fffrflf.exe 39 PID 2788 wrote to memory of 2608 2788 fffrflf.exe 39 PID 2788 wrote to memory of 2608 2788 fffrflf.exe 39 PID 2788 wrote to memory of 2608 2788 fffrflf.exe 39 PID 2608 wrote to memory of 2728 2608 nhhtht.exe 40 PID 2608 wrote to memory of 2728 2608 nhhtht.exe 40 PID 2608 wrote to memory of 2728 2608 nhhtht.exe 40 PID 2608 wrote to memory of 2728 2608 nhhtht.exe 40 PID 2728 wrote to memory of 3056 2728 pdppp.exe 41 PID 2728 wrote to memory of 3056 2728 pdppp.exe 41 PID 2728 wrote to memory of 3056 2728 pdppp.exe 41 PID 2728 wrote to memory of 3056 2728 pdppp.exe 41 PID 3056 wrote to memory of 564 3056 xffrfxr.exe 42 PID 3056 wrote to memory of 564 3056 xffrfxr.exe 42 PID 3056 wrote to memory of 564 3056 xffrfxr.exe 42 PID 3056 wrote to memory of 564 3056 xffrfxr.exe 42 PID 564 wrote to memory of 544 564 nhbhth.exe 43 PID 564 wrote to memory of 544 564 nhbhth.exe 43 PID 564 wrote to memory of 544 564 nhbhth.exe 43 PID 564 wrote to memory of 544 564 nhbhth.exe 43 PID 544 wrote to memory of 2036 544 djjdp.exe 44 PID 544 wrote to memory of 2036 544 djjdp.exe 44 PID 544 wrote to memory of 2036 544 djjdp.exe 44 PID 544 wrote to memory of 2036 544 djjdp.exe 44 PID 2036 wrote to memory of 1296 2036 3ffrrlr.exe 45 PID 2036 wrote to memory of 1296 2036 3ffrrlr.exe 45 PID 2036 wrote to memory of 1296 2036 3ffrrlr.exe 45 PID 2036 wrote to memory of 1296 2036 3ffrrlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jdppv.exec:\jdppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\llllxlf.exec:\llllxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1hhhbh.exec:\1hhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7btbnh.exec:\7btbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vvvdv.exec:\vvvdv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5xfrfrl.exec:\5xfrfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hbtbnn.exec:\hbtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vdpvv.exec:\vdpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\fffrflf.exec:\fffrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nhhtht.exec:\nhhtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pdppp.exec:\pdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xffrfxr.exec:\xffrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nhbhth.exec:\nhbhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\djjdp.exec:\djjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\3ffrrlr.exec:\3ffrrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\1bttnt.exec:\1bttnt.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3vjvp.exec:\3vjvp.exe18⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpjdv.exec:\vpjdv.exe19⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nhbnnb.exec:\nhbnnb.exe20⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7ppdp.exec:\7ppdp.exe21⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1lffxxr.exec:\1lffxxr.exe22⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tttnnb.exec:\tttnnb.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5vjvp.exec:\5vjvp.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\pvvpp.exec:\pvvpp.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3fxfrxr.exec:\3fxfrxr.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5ttntb.exec:\5ttntb.exe27⤵
- Executes dropped EXE
PID:896 -
\??\c:\jdvdj.exec:\jdvdj.exe28⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lrlxlfx.exec:\lrlxlfx.exe29⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbbhbb.exec:\hbbhbb.exe30⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jddjd.exec:\jddjd.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\djddv.exec:\djddv.exe32⤵
- Executes dropped EXE
PID:328 -
\??\c:\xxxfxfr.exec:\xxxfxfr.exe33⤵
- Executes dropped EXE
PID:988 -
\??\c:\ttnnbn.exec:\ttnnbn.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pppjd.exec:\pppjd.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxflxlf.exec:\lxflxlf.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\llfrlxr.exec:\llfrlxr.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bbbntb.exec:\bbbntb.exe38⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vvpdd.exec:\vvpdd.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\1xffrlf.exec:\1xffrlf.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hnthbh.exec:\hnthbh.exe42⤵
- Executes dropped EXE
PID:2256 -
\??\c:\btttnt.exec:\btttnt.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\djvjv.exec:\djvjv.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnnhth.exec:\nnnhth.exe47⤵
- Executes dropped EXE
PID:3056 -
\??\c:\djvjj.exec:\djvjj.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\9pdpp.exec:\9pdpp.exe49⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lrxflfl.exec:\lrxflfl.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rrxrfxf.exec:\rrxrfxf.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nhhnbh.exec:\nhhnbh.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhhbnh.exec:\hhhbnh.exe53⤵
- Executes dropped EXE
PID:1172 -
\??\c:\5ddpd.exec:\5ddpd.exe54⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lllxlrf.exec:\lllxlrf.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bnhhhb.exec:\bnhhhb.exe56⤵
- Executes dropped EXE
PID:800 -
\??\c:\pjpjp.exec:\pjpjp.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dppvd.exec:\dppvd.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rxrrrll.exec:\rxrrrll.exe59⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlflfll.exec:\rlflfll.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tnbtbn.exec:\tnbtbn.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\hhbhth.exec:\hhbhth.exe62⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpjvp.exec:\vpjvp.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jjvjd.exec:\jjvjd.exe64⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xrxfrlf.exec:\xrxfrlf.exe65⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bttnnh.exec:\bttnnh.exe66⤵PID:2972
-
\??\c:\bbhnht.exec:\bbhnht.exe67⤵PID:2280
-
\??\c:\dvddv.exec:\dvddv.exe68⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\vvvdp.exec:\vvvdp.exe69⤵PID:2128
-
\??\c:\rlxfrfl.exec:\rlxfrfl.exe70⤵PID:836
-
\??\c:\hhhttn.exec:\hhhttn.exe71⤵PID:1568
-
\??\c:\9pvdv.exec:\9pvdv.exe72⤵PID:2432
-
\??\c:\ddjdv.exec:\ddjdv.exe73⤵PID:1936
-
\??\c:\rrrrfff.exec:\rrrrfff.exe74⤵PID:2056
-
\??\c:\xflffrl.exec:\xflffrl.exe75⤵PID:2272
-
\??\c:\7dvdp.exec:\7dvdp.exe76⤵PID:3052
-
\??\c:\vvpdp.exec:\vvpdp.exe77⤵PID:1360
-
\??\c:\xxrxrlf.exec:\xxrxrlf.exe78⤵PID:2836
-
\??\c:\7hhhbt.exec:\7hhhbt.exe79⤵PID:2696
-
\??\c:\nbhbnn.exec:\nbhbnn.exe80⤵PID:3008
-
\??\c:\vvpjv.exec:\vvpjv.exe81⤵PID:2856
-
\??\c:\3lfxlrx.exec:\3lfxlrx.exe82⤵PID:2180
-
\??\c:\xffxrfx.exec:\xffxrfx.exe83⤵PID:2616
-
\??\c:\lllxrfx.exec:\lllxrfx.exe84⤵PID:2044
-
\??\c:\hnthtn.exec:\hnthtn.exe85⤵PID:2536
-
\??\c:\hnnbnn.exec:\hnnbnn.exe86⤵PID:2780
-
\??\c:\vvppp.exec:\vvppp.exe87⤵PID:2632
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe88⤵PID:2504
-
\??\c:\flrxflf.exec:\flrxflf.exe89⤵PID:2344
-
\??\c:\bhhthb.exec:\bhhthb.exe90⤵PID:1836
-
\??\c:\hhbbbn.exec:\hhbbbn.exe91⤵PID:2808
-
\??\c:\ppjdd.exec:\ppjdd.exe92⤵PID:1028
-
\??\c:\pdvvj.exec:\pdvvj.exe93⤵PID:1732
-
\??\c:\xffxrrr.exec:\xffxrrr.exe94⤵PID:2656
-
\??\c:\1tntht.exec:\1tntht.exe95⤵PID:1084
-
\??\c:\ttthtt.exec:\ttthtt.exe96⤵PID:2664
-
\??\c:\jdvdj.exec:\jdvdj.exe97⤵PID:2068
-
\??\c:\ppjvd.exec:\ppjvd.exe98⤵PID:2920
-
\??\c:\xxxxxlx.exec:\xxxxxlx.exe99⤵PID:1948
-
\??\c:\rflxxll.exec:\rflxxll.exe100⤵
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\nnhbth.exec:\nnhbth.exe101⤵PID:452
-
\??\c:\thhhnh.exec:\thhhnh.exe102⤵PID:1744
-
\??\c:\pjpjj.exec:\pjpjj.exe103⤵PID:1552
-
\??\c:\flrfrxr.exec:\flrfrxr.exe104⤵PID:1340
-
\??\c:\xflllxr.exec:\xflllxr.exe105⤵PID:1304
-
\??\c:\3bbbbh.exec:\3bbbbh.exe106⤵PID:924
-
\??\c:\bhhhtt.exec:\bhhhtt.exe107⤵PID:1844
-
\??\c:\vdddv.exec:\vdddv.exe108⤵PID:3016
-
\??\c:\vvpvp.exec:\vvpvp.exe109⤵PID:1124
-
\??\c:\7frxrlf.exec:\7frxrlf.exe110⤵PID:1628
-
\??\c:\hhnthn.exec:\hhnthn.exe111⤵PID:2528
-
\??\c:\bbbbth.exec:\bbbbth.exe112⤵PID:988
-
\??\c:\jjjvp.exec:\jjjvp.exe113⤵PID:1944
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe114⤵PID:2200
-
\??\c:\flfxrfx.exec:\flfxrfx.exe115⤵PID:840
-
\??\c:\ttbbhn.exec:\ttbbhn.exe116⤵PID:2220
-
\??\c:\btbbhn.exec:\btbbhn.exe117⤵PID:2124
-
\??\c:\5jdjp.exec:\5jdjp.exe118⤵PID:908
-
\??\c:\pvjpd.exec:\pvjpd.exe119⤵PID:2340
-
\??\c:\xrrlflx.exec:\xrrlflx.exe120⤵PID:2768
-
\??\c:\llffrfx.exec:\llffrfx.exe121⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-