Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe
-
Size
337KB
-
MD5
028c427d409a3ac2182e6fe0e0c1f48b
-
SHA1
6c4c4eee217a02db28969604f574654d64fe82bd
-
SHA256
1580324e54887ef6f3b575948b976f642385cddc88efff044239f23165214f81
-
SHA512
25bd779fa6de71e03d23a353e8098242583cecade8ca0b9dffcb4eacea63bda24b1a55f0c6ea1fc35cc08d1969fe1a17ed871b6b4e1d8065420301267c99d960
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486j8ZAc:Pcm7ImGddXtWrXD486jHc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2524-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/500-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-565-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-578-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-593-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-606-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-693-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-758-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-817-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 bnnnnn.exe 4916 jpvvv.exe 3136 dpddj.exe 4688 5vjvj.exe 2276 tthtbn.exe 3044 pdddv.exe 2156 hhtbtt.exe 708 rrxrrrr.exe 4788 hbhhbb.exe 4432 frfxlxl.exe 1780 ttnnbt.exe 4396 jvdjj.exe 4260 bhtbbb.exe 3952 xxxrrxf.exe 2420 thbhbn.exe 2672 vvppj.exe 1796 xrrxrrl.exe 1448 tntttt.exe 2384 vjdjp.exe 2072 ddpdp.exe 500 nbhhbb.exe 2248 ddppv.exe 3284 pjdvd.exe 2596 hhbtnt.exe 1560 frrlxxl.exe 2808 nbnbbt.exe 4400 dvdjv.exe 1092 1ppjv.exe 4976 7xfxrxr.exe 2068 bhthht.exe 3276 hhhbbb.exe 1348 vjvjj.exe 2484 xfrlflf.exe 3236 1tnbht.exe 884 jdjvp.exe 1036 rlflxrx.exe 1316 htbtnn.exe 412 pvdpj.exe 1500 lfflffl.exe 1692 htbbbh.exe 2900 vpvjv.exe 228 pvjpv.exe 4596 9btnht.exe 1912 vddvp.exe 2080 1ffxrxx.exe 2156 tnhhnt.exe 4780 vjvpd.exe 4992 9rlflrr.exe 2624 bntbbh.exe 4432 1vddv.exe 1512 9jvjv.exe 4388 5ffxllf.exe 3484 hbnttn.exe 3288 djvdp.exe 1696 fxrllll.exe 1752 hbthth.exe 1280 djjvj.exe 4692 dpddv.exe 2436 rrlrlxr.exe 4832 hnthtt.exe 4120 vpdpj.exe 1564 fflrrfl.exe 1040 nnnnhh.exe 1464 vvjjj.exe -
resource yara_rule behavioral2/memory/2524-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/500-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-398-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2524 1964 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 84 PID 1964 wrote to memory of 2524 1964 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 84 PID 1964 wrote to memory of 2524 1964 028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe 84 PID 2524 wrote to memory of 4916 2524 bnnnnn.exe 85 PID 2524 wrote to memory of 4916 2524 bnnnnn.exe 85 PID 2524 wrote to memory of 4916 2524 bnnnnn.exe 85 PID 4916 wrote to memory of 3136 4916 jpvvv.exe 86 PID 4916 wrote to memory of 3136 4916 jpvvv.exe 86 PID 4916 wrote to memory of 3136 4916 jpvvv.exe 86 PID 3136 wrote to memory of 4688 3136 dpddj.exe 87 PID 3136 wrote to memory of 4688 3136 dpddj.exe 87 PID 3136 wrote to memory of 4688 3136 dpddj.exe 87 PID 4688 wrote to memory of 2276 4688 5vjvj.exe 88 PID 4688 wrote to memory of 2276 4688 5vjvj.exe 88 PID 4688 wrote to memory of 2276 4688 5vjvj.exe 88 PID 2276 wrote to memory of 3044 2276 tthtbn.exe 89 PID 2276 wrote to memory of 3044 2276 tthtbn.exe 89 PID 2276 wrote to memory of 3044 2276 tthtbn.exe 89 PID 3044 wrote to memory of 2156 3044 pdddv.exe 90 PID 3044 wrote to memory of 2156 3044 pdddv.exe 90 PID 3044 wrote to memory of 2156 3044 pdddv.exe 90 PID 2156 wrote to memory of 708 2156 hhtbtt.exe 91 PID 2156 wrote to memory of 708 2156 hhtbtt.exe 91 PID 2156 wrote to memory of 708 2156 hhtbtt.exe 91 PID 708 wrote to memory of 4788 708 rrxrrrr.exe 93 PID 708 wrote to memory of 4788 708 rrxrrrr.exe 93 PID 708 wrote to memory of 4788 708 rrxrrrr.exe 93 PID 4788 wrote to memory of 4432 4788 hbhhbb.exe 94 PID 4788 wrote to memory of 4432 4788 hbhhbb.exe 94 PID 4788 wrote to memory of 4432 4788 hbhhbb.exe 94 PID 4432 wrote to memory of 1780 4432 frfxlxl.exe 95 PID 4432 wrote to memory of 1780 4432 frfxlxl.exe 95 PID 4432 wrote to memory of 1780 4432 frfxlxl.exe 95 PID 1780 wrote to memory of 4396 1780 ttnnbt.exe 96 PID 1780 wrote to memory of 4396 1780 ttnnbt.exe 96 PID 1780 wrote to memory of 4396 1780 ttnnbt.exe 96 PID 4396 wrote to memory of 4260 4396 jvdjj.exe 98 PID 4396 wrote to memory of 4260 4396 jvdjj.exe 98 PID 4396 wrote to memory of 4260 4396 jvdjj.exe 98 PID 4260 wrote to memory of 3952 4260 bhtbbb.exe 99 PID 4260 wrote to memory of 3952 4260 bhtbbb.exe 99 PID 4260 wrote to memory of 3952 4260 bhtbbb.exe 99 PID 3952 wrote to memory of 2420 3952 xxxrrxf.exe 100 PID 3952 wrote to memory of 2420 3952 xxxrrxf.exe 100 PID 3952 wrote to memory of 2420 3952 xxxrrxf.exe 100 PID 2420 wrote to memory of 2672 2420 thbhbn.exe 101 PID 2420 wrote to memory of 2672 2420 thbhbn.exe 101 PID 2420 wrote to memory of 2672 2420 thbhbn.exe 101 PID 2672 wrote to memory of 1796 2672 vvppj.exe 103 PID 2672 wrote to memory of 1796 2672 vvppj.exe 103 PID 2672 wrote to memory of 1796 2672 vvppj.exe 103 PID 1796 wrote to memory of 1448 1796 xrrxrrl.exe 104 PID 1796 wrote to memory of 1448 1796 xrrxrrl.exe 104 PID 1796 wrote to memory of 1448 1796 xrrxrrl.exe 104 PID 1448 wrote to memory of 2384 1448 tntttt.exe 105 PID 1448 wrote to memory of 2384 1448 tntttt.exe 105 PID 1448 wrote to memory of 2384 1448 tntttt.exe 105 PID 2384 wrote to memory of 2072 2384 vjdjp.exe 106 PID 2384 wrote to memory of 2072 2384 vjdjp.exe 106 PID 2384 wrote to memory of 2072 2384 vjdjp.exe 106 PID 2072 wrote to memory of 500 2072 ddpdp.exe 107 PID 2072 wrote to memory of 500 2072 ddpdp.exe 107 PID 2072 wrote to memory of 500 2072 ddpdp.exe 107 PID 500 wrote to memory of 2248 500 nbhhbb.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\028c427d409a3ac2182e6fe0e0c1f48b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bnnnnn.exec:\bnnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jpvvv.exec:\jpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\dpddj.exec:\dpddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\5vjvj.exec:\5vjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\tthtbn.exec:\tthtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pdddv.exec:\pdddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hhtbtt.exec:\hhtbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\hbhhbb.exec:\hbhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\frfxlxl.exec:\frfxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\ttnnbt.exec:\ttnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jvdjj.exec:\jvdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\bhtbbb.exec:\bhtbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\xxxrrxf.exec:\xxxrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\thbhbn.exec:\thbhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vvppj.exec:\vvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\tntttt.exec:\tntttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\vjdjp.exec:\vjdjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ddpdp.exec:\ddpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nbhhbb.exec:\nbhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\ddppv.exec:\ddppv.exe23⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pjdvd.exec:\pjdvd.exe24⤵
- Executes dropped EXE
PID:3284 -
\??\c:\hhbtnt.exec:\hhbtnt.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\frrlxxl.exec:\frrlxxl.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nbnbbt.exec:\nbnbbt.exe27⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvdjv.exec:\dvdjv.exe28⤵
- Executes dropped EXE
PID:4400 -
\??\c:\1ppjv.exec:\1ppjv.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7xfxrxr.exec:\7xfxrxr.exe30⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bhthht.exec:\bhthht.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hhhbbb.exec:\hhhbbb.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\vjvjj.exec:\vjvjj.exe33⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xfrlflf.exec:\xfrlflf.exe34⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1tnbht.exec:\1tnbht.exe35⤵
- Executes dropped EXE
PID:3236 -
\??\c:\jdjvp.exec:\jdjvp.exe36⤵
- Executes dropped EXE
PID:884 -
\??\c:\rlflxrx.exec:\rlflxrx.exe37⤵
- Executes dropped EXE
PID:1036 -
\??\c:\htbtnn.exec:\htbtnn.exe38⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pvdpj.exec:\pvdpj.exe39⤵
- Executes dropped EXE
PID:412 -
\??\c:\lfflffl.exec:\lfflffl.exe40⤵
- Executes dropped EXE
PID:1500 -
\??\c:\htbbbh.exec:\htbbbh.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vpvjv.exec:\vpvjv.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pvjpv.exec:\pvjpv.exe43⤵
- Executes dropped EXE
PID:228 -
\??\c:\9btnht.exec:\9btnht.exe44⤵
- Executes dropped EXE
PID:4596 -
\??\c:\vddvp.exec:\vddvp.exe45⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1ffxrxx.exec:\1ffxrxx.exe46⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tnhhnt.exec:\tnhhnt.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vjvpd.exec:\vjvpd.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\9rlflrr.exec:\9rlflrr.exe49⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bntbbh.exec:\bntbbh.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1vddv.exec:\1vddv.exe51⤵
- Executes dropped EXE
PID:4432 -
\??\c:\9jvjv.exec:\9jvjv.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5ffxllf.exec:\5ffxllf.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hbnttn.exec:\hbnttn.exe54⤵
- Executes dropped EXE
PID:3484 -
\??\c:\djvdp.exec:\djvdp.exe55⤵
- Executes dropped EXE
PID:3288 -
\??\c:\fxrllll.exec:\fxrllll.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hbthth.exec:\hbthth.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\djjvj.exec:\djjvj.exe58⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dpddv.exec:\dpddv.exe59⤵
- Executes dropped EXE
PID:4692 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe60⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hnthtt.exec:\hnthtt.exe61⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vpdpj.exec:\vpdpj.exe62⤵
- Executes dropped EXE
PID:4120 -
\??\c:\fflrrfl.exec:\fflrrfl.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nnnnhh.exec:\nnnnhh.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vvjjj.exec:\vvjjj.exe65⤵
- Executes dropped EXE
PID:1464 -
\??\c:\xxxffll.exec:\xxxffll.exe66⤵PID:1068
-
\??\c:\rllfxrl.exec:\rllfxrl.exe67⤵PID:3220
-
\??\c:\thnnnh.exec:\thnnnh.exe68⤵PID:3780
-
\??\c:\djpjv.exec:\djpjv.exe69⤵PID:368
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe70⤵PID:4888
-
\??\c:\frffxrl.exec:\frffxrl.exe71⤵PID:4848
-
\??\c:\hnbthb.exec:\hnbthb.exe72⤵PID:1560
-
\??\c:\vpdvv.exec:\vpdvv.exe73⤵PID:4516
-
\??\c:\rfrllll.exec:\rfrllll.exe74⤵PID:3900
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe75⤵PID:4044
-
\??\c:\bthbtb.exec:\bthbtb.exe76⤵PID:3552
-
\??\c:\vvjjp.exec:\vvjjp.exe77⤵PID:4976
-
\??\c:\xffxrrl.exec:\xffxrrl.exe78⤵PID:4508
-
\??\c:\7btnhh.exec:\7btnhh.exe79⤵PID:2352
-
\??\c:\vdjvp.exec:\vdjvp.exe80⤵PID:4736
-
\??\c:\rrfrflx.exec:\rrfrflx.exe81⤵PID:3856
-
\??\c:\bbbnhn.exec:\bbbnhn.exe82⤵PID:3424
-
\??\c:\pppjp.exec:\pppjp.exe83⤵PID:4412
-
\??\c:\pdpjv.exec:\pdpjv.exe84⤵PID:4336
-
\??\c:\rlxrrll.exec:\rlxrrll.exe85⤵PID:3188
-
\??\c:\tbthhn.exec:\tbthhn.exe86⤵PID:1036
-
\??\c:\ppjdp.exec:\ppjdp.exe87⤵PID:3300
-
\??\c:\dpvpj.exec:\dpvpj.exe88⤵PID:412
-
\??\c:\xllfrlf.exec:\xllfrlf.exe89⤵PID:2704
-
\??\c:\7tnhtt.exec:\7tnhtt.exe90⤵PID:2660
-
\??\c:\jdjdj.exec:\jdjdj.exe91⤵PID:2900
-
\??\c:\rxfxxlx.exec:\rxfxxlx.exe92⤵PID:2004
-
\??\c:\nnbttn.exec:\nnbttn.exe93⤵PID:4596
-
\??\c:\bhtbhn.exec:\bhtbhn.exe94⤵PID:1912
-
\??\c:\vjvpd.exec:\vjvpd.exe95⤵PID:3704
-
\??\c:\fllxlfr.exec:\fllxlfr.exe96⤵PID:852
-
\??\c:\vjvvv.exec:\vjvvv.exe97⤵PID:3768
-
\??\c:\vjpjj.exec:\vjpjj.exe98⤵PID:4528
-
\??\c:\bhnhbn.exec:\bhnhbn.exe99⤵PID:2624
-
\??\c:\3pdpj.exec:\3pdpj.exe100⤵PID:3536
-
\??\c:\rlffllr.exec:\rlffllr.exe101⤵PID:1780
-
\??\c:\lffxrxr.exec:\lffxrxr.exe102⤵PID:4388
-
\??\c:\nnnnhn.exec:\nnnnhn.exe103⤵PID:3484
-
\??\c:\vppdj.exec:\vppdj.exe104⤵PID:4920
-
\??\c:\xllfxxr.exec:\xllfxxr.exe105⤵PID:4504
-
\??\c:\bbhnht.exec:\bbhnht.exe106⤵PID:1624
-
\??\c:\vvvdp.exec:\vvvdp.exe107⤵PID:4712
-
\??\c:\jvvpj.exec:\jvvpj.exe108⤵PID:2420
-
\??\c:\hnnbtt.exec:\hnnbtt.exe109⤵PID:528
-
\??\c:\httnhh.exec:\httnhh.exe110⤵PID:2772
-
\??\c:\1pjjj.exec:\1pjjj.exe111⤵PID:1644
-
\??\c:\xffxrrl.exec:\xffxrrl.exe112⤵PID:4668
-
\??\c:\nnbbtb.exec:\nnbbtb.exe113⤵PID:4764
-
\??\c:\bnhhnn.exec:\bnhhnn.exe114⤵PID:3452
-
\??\c:\jpvdp.exec:\jpvdp.exe115⤵PID:1228
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe116⤵PID:2528
-
\??\c:\1hnhtt.exec:\1hnhtt.exe117⤵PID:2744
-
\??\c:\nbbhbb.exec:\nbbhbb.exe118⤵PID:976
-
\??\c:\pddvp.exec:\pddvp.exe119⤵PID:2164
-
\??\c:\fxlffxr.exec:\fxlffxr.exe120⤵PID:2272
-
\??\c:\pvpjv.exec:\pvpjv.exe121⤵PID:4400
-
\??\c:\1jjjd.exec:\1jjjd.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-