Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 23:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe
-
Size
211KB
-
MD5
02bbb7293c597c56b62a7af045fa1315
-
SHA1
cfbeb38ea88bc2ff35019ee8004eb180e9435d30
-
SHA256
706c2afeb8eedd4ce52275ee3906d303f4a3db43e738153c0ba23f7c99a91bf5
-
SHA512
d7b2e02421b2003349c11e1f1b65b9f87e40a22e9b63c913bb173a08c75790b975ac2cf9b69f604ad5e579dbf6b84f00d2cf1765d3c9f3ac17ef2724dcb09ba9
-
SSDEEP
3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5VaQvytQW7:Ecm7ImGddXyt38TU5LW
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4672-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4672 4220480.exe 3604 2644068.exe 4968 808022.exe 4908 62200.exe 4956 o806664.exe 5036 846600.exe 1340 84226.exe 4344 64260.exe 4944 4000066.exe 4560 06884.exe 1880 28444.exe 268 0426224.exe 3928 e28660.exe 2064 60200.exe 2140 062420.exe 4792 m4404.exe 1260 4404046.exe 3748 404600.exe 3572 406606.exe 4896 82666.exe 4664 0282226.exe 3248 624400.exe 3228 28048.exe 3896 g2648.exe 3220 4622602.exe 1200 000040.exe 4568 046066.exe 1744 s8646.exe 2200 o682266.exe 2696 e46088.exe 3216 s8826.exe 2924 8822828.exe 1296 8802440.exe 4848 k24888.exe 840 024822.exe 1100 28404.exe 3976 86646.exe 4776 0060066.exe 4412 624888.exe 2960 684844.exe 2008 08686.exe 2188 6686260.exe 4884 6222200.exe 3936 006200.exe 1564 88602.exe 2552 4680202.exe 3552 4682224.exe 4540 q82662.exe 3376 s0626.exe 4956 a2084.exe 1440 2820828.exe 4112 k28244.exe 4684 40420.exe 2644 2800066.exe 2116 466420.exe 2928 628822.exe 4988 04004.exe 544 2680880.exe 4580 2280444.exe 3336 046604.exe 2228 00004.exe 4720 00826.exe 2528 8242426.exe 4496 668662.exe -
resource yara_rule behavioral2/memory/4672-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/268-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/352-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-487-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6626448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c282264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8800446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3936 wrote to memory of 4672 3936 02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe 83 PID 3936 wrote to memory of 4672 3936 02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe 83 PID 3936 wrote to memory of 4672 3936 02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe 83 PID 4672 wrote to memory of 3604 4672 4220480.exe 84 PID 4672 wrote to memory of 3604 4672 4220480.exe 84 PID 4672 wrote to memory of 3604 4672 4220480.exe 84 PID 3604 wrote to memory of 4968 3604 2644068.exe 85 PID 3604 wrote to memory of 4968 3604 2644068.exe 85 PID 3604 wrote to memory of 4968 3604 2644068.exe 85 PID 4968 wrote to memory of 4908 4968 808022.exe 86 PID 4968 wrote to memory of 4908 4968 808022.exe 86 PID 4968 wrote to memory of 4908 4968 808022.exe 86 PID 4908 wrote to memory of 4956 4908 62200.exe 87 PID 4908 wrote to memory of 4956 4908 62200.exe 87 PID 4908 wrote to memory of 4956 4908 62200.exe 87 PID 4956 wrote to memory of 5036 4956 o806664.exe 88 PID 4956 wrote to memory of 5036 4956 o806664.exe 88 PID 4956 wrote to memory of 5036 4956 o806664.exe 88 PID 5036 wrote to memory of 1340 5036 846600.exe 89 PID 5036 wrote to memory of 1340 5036 846600.exe 89 PID 5036 wrote to memory of 1340 5036 846600.exe 89 PID 1340 wrote to memory of 4344 1340 84226.exe 90 PID 1340 wrote to memory of 4344 1340 84226.exe 90 PID 1340 wrote to memory of 4344 1340 84226.exe 90 PID 4344 wrote to memory of 4944 4344 64260.exe 91 PID 4344 wrote to memory of 4944 4344 64260.exe 91 PID 4344 wrote to memory of 4944 4344 64260.exe 91 PID 4944 wrote to memory of 4560 4944 4000066.exe 92 PID 4944 wrote to memory of 4560 4944 4000066.exe 92 PID 4944 wrote to memory of 4560 4944 4000066.exe 92 PID 4560 wrote to memory of 1880 4560 06884.exe 93 PID 4560 wrote to memory of 1880 4560 06884.exe 93 PID 4560 wrote to memory of 1880 4560 06884.exe 93 PID 1880 wrote to memory of 268 1880 28444.exe 94 PID 1880 wrote to memory of 268 1880 28444.exe 94 PID 1880 wrote to memory of 268 1880 28444.exe 94 PID 268 wrote to memory of 3928 268 0426224.exe 96 PID 268 wrote to memory of 3928 268 0426224.exe 96 PID 268 wrote to memory of 3928 268 0426224.exe 96 PID 3928 wrote to memory of 2064 3928 e28660.exe 97 PID 3928 wrote to memory of 2064 3928 e28660.exe 97 PID 3928 wrote to memory of 2064 3928 e28660.exe 97 PID 2064 wrote to memory of 2140 2064 60200.exe 98 PID 2064 wrote to memory of 2140 2064 60200.exe 98 PID 2064 wrote to memory of 2140 2064 60200.exe 98 PID 2140 wrote to memory of 4792 2140 062420.exe 100 PID 2140 wrote to memory of 4792 2140 062420.exe 100 PID 2140 wrote to memory of 4792 2140 062420.exe 100 PID 4792 wrote to memory of 1260 4792 m4404.exe 101 PID 4792 wrote to memory of 1260 4792 m4404.exe 101 PID 4792 wrote to memory of 1260 4792 m4404.exe 101 PID 1260 wrote to memory of 3748 1260 4404046.exe 102 PID 1260 wrote to memory of 3748 1260 4404046.exe 102 PID 1260 wrote to memory of 3748 1260 4404046.exe 102 PID 3748 wrote to memory of 3572 3748 404600.exe 103 PID 3748 wrote to memory of 3572 3748 404600.exe 103 PID 3748 wrote to memory of 3572 3748 404600.exe 103 PID 3572 wrote to memory of 4896 3572 406606.exe 104 PID 3572 wrote to memory of 4896 3572 406606.exe 104 PID 3572 wrote to memory of 4896 3572 406606.exe 104 PID 4896 wrote to memory of 4664 4896 82666.exe 106 PID 4896 wrote to memory of 4664 4896 82666.exe 106 PID 4896 wrote to memory of 4664 4896 82666.exe 106 PID 4664 wrote to memory of 3248 4664 0282226.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02bbb7293c597c56b62a7af045fa1315_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\4220480.exec:\4220480.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\2644068.exec:\2644068.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\808022.exec:\808022.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\62200.exec:\62200.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\o806664.exec:\o806664.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\846600.exec:\846600.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\84226.exec:\84226.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\64260.exec:\64260.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\4000066.exec:\4000066.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\06884.exec:\06884.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\28444.exec:\28444.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\0426224.exec:\0426224.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\e28660.exec:\e28660.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\60200.exec:\60200.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\062420.exec:\062420.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\m4404.exec:\m4404.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\4404046.exec:\4404046.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\404600.exec:\404600.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\406606.exec:\406606.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\82666.exec:\82666.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\0282226.exec:\0282226.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\624400.exec:\624400.exe23⤵
- Executes dropped EXE
PID:3248 -
\??\c:\28048.exec:\28048.exe24⤵
- Executes dropped EXE
PID:3228 -
\??\c:\g2648.exec:\g2648.exe25⤵
- Executes dropped EXE
PID:3896 -
\??\c:\4622602.exec:\4622602.exe26⤵
- Executes dropped EXE
PID:3220 -
\??\c:\000040.exec:\000040.exe27⤵
- Executes dropped EXE
PID:1200 -
\??\c:\046066.exec:\046066.exe28⤵
- Executes dropped EXE
PID:4568 -
\??\c:\s8646.exec:\s8646.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\o682266.exec:\o682266.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\e46088.exec:\e46088.exe31⤵
- Executes dropped EXE
PID:2696 -
\??\c:\s8826.exec:\s8826.exe32⤵
- Executes dropped EXE
PID:3216 -
\??\c:\8822828.exec:\8822828.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\8802440.exec:\8802440.exe34⤵
- Executes dropped EXE
PID:1296 -
\??\c:\k24888.exec:\k24888.exe35⤵
- Executes dropped EXE
PID:4848 -
\??\c:\024822.exec:\024822.exe36⤵
- Executes dropped EXE
PID:840 -
\??\c:\28404.exec:\28404.exe37⤵
- Executes dropped EXE
PID:1100 -
\??\c:\86646.exec:\86646.exe38⤵
- Executes dropped EXE
PID:3976 -
\??\c:\0060066.exec:\0060066.exe39⤵
- Executes dropped EXE
PID:4776 -
\??\c:\624888.exec:\624888.exe40⤵
- Executes dropped EXE
PID:4412 -
\??\c:\684844.exec:\684844.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\08686.exec:\08686.exe42⤵
- Executes dropped EXE
PID:2008 -
\??\c:\6686260.exec:\6686260.exe43⤵
- Executes dropped EXE
PID:2188 -
\??\c:\6222200.exec:\6222200.exe44⤵
- Executes dropped EXE
PID:4884 -
\??\c:\006200.exec:\006200.exe45⤵
- Executes dropped EXE
PID:3936 -
\??\c:\88602.exec:\88602.exe46⤵
- Executes dropped EXE
PID:1564 -
\??\c:\4680202.exec:\4680202.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\4682224.exec:\4682224.exe48⤵
- Executes dropped EXE
PID:3552 -
\??\c:\q82662.exec:\q82662.exe49⤵
- Executes dropped EXE
PID:4540 -
\??\c:\s0626.exec:\s0626.exe50⤵
- Executes dropped EXE
PID:3376 -
\??\c:\a2084.exec:\a2084.exe51⤵
- Executes dropped EXE
PID:4956 -
\??\c:\2820828.exec:\2820828.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\k28244.exec:\k28244.exe53⤵
- Executes dropped EXE
PID:4112 -
\??\c:\40420.exec:\40420.exe54⤵
- Executes dropped EXE
PID:4684 -
\??\c:\2800066.exec:\2800066.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\466420.exec:\466420.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\628822.exec:\628822.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\04004.exec:\04004.exe58⤵
- Executes dropped EXE
PID:4988 -
\??\c:\2680880.exec:\2680880.exe59⤵
- Executes dropped EXE
PID:544 -
\??\c:\2280444.exec:\2280444.exe60⤵
- Executes dropped EXE
PID:4580 -
\??\c:\046604.exec:\046604.exe61⤵
- Executes dropped EXE
PID:3336 -
\??\c:\00004.exec:\00004.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\00826.exec:\00826.exe63⤵
- Executes dropped EXE
PID:4720 -
\??\c:\8242426.exec:\8242426.exe64⤵
- Executes dropped EXE
PID:2528 -
\??\c:\668662.exec:\668662.exe65⤵
- Executes dropped EXE
PID:4496 -
\??\c:\26064.exec:\26064.exe66⤵PID:1780
-
\??\c:\62802.exec:\62802.exe67⤵PID:3560
-
\??\c:\k64802.exec:\k64802.exe68⤵PID:1372
-
\??\c:\600400.exec:\600400.exe69⤵PID:184
-
\??\c:\g4000.exec:\g4000.exe70⤵PID:4680
-
\??\c:\6084644.exec:\6084644.exe71⤵PID:1352
-
\??\c:\i444444.exec:\i444444.exe72⤵PID:388
-
\??\c:\268044.exec:\268044.exe73⤵PID:3572
-
\??\c:\s4604.exec:\s4604.exe74⤵PID:3188
-
\??\c:\46820.exec:\46820.exe75⤵PID:520
-
\??\c:\o060882.exec:\o060882.exe76⤵PID:392
-
\??\c:\884488.exec:\884488.exe77⤵PID:3248
-
\??\c:\e80488.exec:\e80488.exe78⤵PID:548
-
\??\c:\28442.exec:\28442.exe79⤵PID:3148
-
\??\c:\c644884.exec:\c644884.exe80⤵PID:2576
-
\??\c:\600442.exec:\600442.exe81⤵PID:2732
-
\??\c:\g2266.exec:\g2266.exe82⤵PID:1996
-
\??\c:\86660.exec:\86660.exe83⤵PID:4232
-
\??\c:\6220448.exec:\6220448.exe84⤵PID:884
-
\??\c:\u444488.exec:\u444488.exe85⤵PID:1900
-
\??\c:\644866.exec:\644866.exe86⤵PID:1540
-
\??\c:\04482.exec:\04482.exe87⤵PID:3960
-
\??\c:\u848200.exec:\u848200.exe88⤵PID:1208
-
\??\c:\6028224.exec:\6028224.exe89⤵PID:2132
-
\??\c:\480602.exec:\480602.exe90⤵PID:4480
-
\??\c:\k40426.exec:\k40426.exe91⤵PID:4432
-
\??\c:\04604.exec:\04604.exe92⤵PID:1484
-
\??\c:\6626448.exec:\6626448.exe93⤵
- System Location Discovery: System Language Discovery
PID:2548 -
\??\c:\6640688.exec:\6640688.exe94⤵PID:3736
-
\??\c:\e00482.exec:\e00482.exe95⤵PID:4412
-
\??\c:\48882.exec:\48882.exe96⤵PID:2960
-
\??\c:\8848844.exec:\8848844.exe97⤵PID:4320
-
\??\c:\468822.exec:\468822.exe98⤵PID:2256
-
\??\c:\624422.exec:\624422.exe99⤵PID:1564
-
\??\c:\04844.exec:\04844.exe100⤵PID:4968
-
\??\c:\8422604.exec:\8422604.exe101⤵PID:1560
-
\??\c:\o280000.exec:\o280000.exe102⤵PID:3624
-
\??\c:\224860.exec:\224860.exe103⤵PID:1116
-
\??\c:\w00422.exec:\w00422.exe104⤵PID:4400
-
\??\c:\62486.exec:\62486.exe105⤵PID:4484
-
\??\c:\2426004.exec:\2426004.exe106⤵PID:4112
-
\??\c:\8648664.exec:\8648664.exe107⤵PID:420
-
\??\c:\068260.exec:\068260.exe108⤵PID:2644
-
\??\c:\628486.exec:\628486.exe109⤵PID:2468
-
\??\c:\28828.exec:\28828.exe110⤵PID:3048
-
\??\c:\2288004.exec:\2288004.exe111⤵PID:352
-
\??\c:\628060.exec:\628060.exe112⤵PID:1568
-
\??\c:\8422648.exec:\8422648.exe113⤵PID:4016
-
\??\c:\o822666.exec:\o822666.exe114⤵PID:2228
-
\??\c:\844804.exec:\844804.exe115⤵PID:4444
-
\??\c:\884822.exec:\884822.exe116⤵PID:3284
-
\??\c:\00242.exec:\00242.exe117⤵PID:1668
-
\??\c:\s0084.exec:\s0084.exe118⤵PID:816
-
\??\c:\4882660.exec:\4882660.exe119⤵PID:3560
-
\??\c:\2884062.exec:\2884062.exe120⤵PID:2660
-
\??\c:\204406.exec:\204406.exe121⤵PID:4996
-
\??\c:\02848.exec:\02848.exe122⤵PID:3748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-