Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe
-
Size
419KB
-
MD5
02c27687ebd579e7c03e54637e9de742
-
SHA1
c599702da6e7e634506289b347b40597b7983147
-
SHA256
c728f253c618bae5809011866dc1cf34ff0af6e434251d122e9784671ea191ae
-
SHA512
ef305b2c5759baaa1ec059dffee2e791e38e9cb8238aad345f6c770146546a9184a4fb2026bcebf9e96d2ed14daa6da47d42d819403ba1d7d684796cdd6ff733
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwD7arnDX+X5l5xb:8cm7ImGddXmNt251UriZFwfsDX+XtR
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2772-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-51-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2324-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-464-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1384-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-524-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1112-810-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/996-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-611-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1464-603-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2992-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-906-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/568-938-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 pffffpv.exe 2380 djjnd.exe 2188 lvlttjd.exe 2772 jddrbf.exe 2996 phdfl.exe 2904 bjplv.exe 2132 fbpfbp.exe 1028 xrdjb.exe 2636 jtptrp.exe 2752 rnnxtd.exe 2692 flljbnd.exe 1496 nbpprrl.exe 1920 ffvdb.exe 1776 hhlrdb.exe 2928 htpflxf.exe 1144 lttnv.exe 1984 flpddb.exe 2324 fdpjxp.exe 2284 pntjn.exe 2248 nbxffjx.exe 1584 vlhjjdf.exe 2084 lvltt.exe 808 xnlvnxb.exe 684 rvhtj.exe 1740 vfhdlln.exe 1632 dtvjxnb.exe 2428 tjhprx.exe 2604 xfdhf.exe 3020 bxrnvbv.exe 2204 tnxjd.exe 760 tvvlvpt.exe 544 dtftjd.exe 1684 jlbnnj.exe 2560 rxbxv.exe 2356 pplnnjr.exe 1540 hhhjj.exe 2724 rhbvn.exe 2504 xxdptbv.exe 2108 rjthrn.exe 2736 rxdfbbp.exe 2824 frhrbj.exe 2052 tlrpdt.exe 2132 xvptr.exe 2880 trbfxnn.exe 3052 xbphltv.exe 1912 ldfbv.exe 2748 jxtpbbn.exe 1696 xpnhffv.exe 2524 tbdvtf.exe 1920 bjttfbb.exe 1312 vttpdl.exe 2684 dhbllt.exe 1492 xfrhflt.exe 2104 dpjvv.exe 1180 vhbfh.exe 2320 fhrpxnb.exe 2284 lbdnl.exe 2248 rpjtrv.exe 1032 ppfdnbn.exe 2100 nddrj.exe 1152 rnxvxx.exe 2208 djddpth.exe 1644 ndhltv.exe 1384 bntrxh.exe -
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-523-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2100-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-913-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnlxfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrhld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlvjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbhrtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rntvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrlrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdfhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrfxtjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnxvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txndfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvtfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjljnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdfhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nppjdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpvbxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbnhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtpbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntrrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrpjddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnvbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdxxdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvpfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btrrhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2908 2388 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 531 PID 2388 wrote to memory of 2908 2388 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 531 PID 2388 wrote to memory of 2908 2388 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 531 PID 2388 wrote to memory of 2908 2388 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 531 PID 2908 wrote to memory of 2380 2908 pffffpv.exe 418 PID 2908 wrote to memory of 2380 2908 pffffpv.exe 418 PID 2908 wrote to memory of 2380 2908 pffffpv.exe 418 PID 2908 wrote to memory of 2380 2908 pffffpv.exe 418 PID 2380 wrote to memory of 2188 2380 djjnd.exe 236 PID 2380 wrote to memory of 2188 2380 djjnd.exe 236 PID 2380 wrote to memory of 2188 2380 djjnd.exe 236 PID 2380 wrote to memory of 2188 2380 djjnd.exe 236 PID 2188 wrote to memory of 2772 2188 lvlttjd.exe 234 PID 2188 wrote to memory of 2772 2188 lvlttjd.exe 234 PID 2188 wrote to memory of 2772 2188 lvlttjd.exe 234 PID 2188 wrote to memory of 2772 2188 lvlttjd.exe 234 PID 2772 wrote to memory of 2996 2772 jddrbf.exe 150 PID 2772 wrote to memory of 2996 2772 jddrbf.exe 150 PID 2772 wrote to memory of 2996 2772 jddrbf.exe 150 PID 2772 wrote to memory of 2996 2772 jddrbf.exe 150 PID 2996 wrote to memory of 2904 2996 phdfl.exe 238 PID 2996 wrote to memory of 2904 2996 phdfl.exe 238 PID 2996 wrote to memory of 2904 2996 phdfl.exe 238 PID 2996 wrote to memory of 2904 2996 phdfl.exe 238 PID 2904 wrote to memory of 2132 2904 bjplv.exe 761 PID 2904 wrote to memory of 2132 2904 bjplv.exe 761 PID 2904 wrote to memory of 2132 2904 bjplv.exe 761 PID 2904 wrote to memory of 2132 2904 bjplv.exe 761 PID 2132 wrote to memory of 1028 2132 fbpfbp.exe 200 PID 2132 wrote to memory of 1028 2132 fbpfbp.exe 200 PID 2132 wrote to memory of 1028 2132 fbpfbp.exe 200 PID 2132 wrote to memory of 1028 2132 fbpfbp.exe 200 PID 1028 wrote to memory of 2636 1028 xrdjb.exe 202 PID 1028 wrote to memory of 2636 1028 xrdjb.exe 202 PID 1028 wrote to memory of 2636 1028 xrdjb.exe 202 PID 1028 wrote to memory of 2636 1028 xrdjb.exe 202 PID 2636 wrote to memory of 2752 2636 jtptrp.exe 571 PID 2636 wrote to memory of 2752 2636 jtptrp.exe 571 PID 2636 wrote to memory of 2752 2636 jtptrp.exe 571 PID 2636 wrote to memory of 2752 2636 jtptrp.exe 571 PID 2752 wrote to memory of 2692 2752 rnnxtd.exe 480 PID 2752 wrote to memory of 2692 2752 rnnxtd.exe 480 PID 2752 wrote to memory of 2692 2752 rnnxtd.exe 480 PID 2752 wrote to memory of 2692 2752 rnnxtd.exe 480 PID 2692 wrote to memory of 1496 2692 flljbnd.exe 716 PID 2692 wrote to memory of 1496 2692 flljbnd.exe 716 PID 2692 wrote to memory of 1496 2692 flljbnd.exe 716 PID 2692 wrote to memory of 1496 2692 flljbnd.exe 716 PID 1496 wrote to memory of 1920 1496 nbpprrl.exe 532 PID 1496 wrote to memory of 1920 1496 nbpprrl.exe 532 PID 1496 wrote to memory of 1920 1496 nbpprrl.exe 532 PID 1496 wrote to memory of 1920 1496 nbpprrl.exe 532 PID 1920 wrote to memory of 1776 1920 ffvdb.exe 207 PID 1920 wrote to memory of 1776 1920 ffvdb.exe 207 PID 1920 wrote to memory of 1776 1920 ffvdb.exe 207 PID 1920 wrote to memory of 1776 1920 ffvdb.exe 207 PID 1776 wrote to memory of 2928 1776 hhlrdb.exe 582 PID 1776 wrote to memory of 2928 1776 hhlrdb.exe 582 PID 1776 wrote to memory of 2928 1776 hhlrdb.exe 582 PID 1776 wrote to memory of 2928 1776 hhlrdb.exe 582 PID 2928 wrote to memory of 1144 2928 htpflxf.exe 491 PID 2928 wrote to memory of 1144 2928 htpflxf.exe 491 PID 2928 wrote to memory of 1144 2928 htpflxf.exe 491 PID 2928 wrote to memory of 1144 2928 htpflxf.exe 491
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pffffpv.exec:\pffffpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\djjnd.exec:\djjnd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lvlttjd.exec:\lvlttjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jddrbf.exec:\jddrbf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\phdfl.exec:\phdfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bjplv.exec:\bjplv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\fbpfbp.exec:\fbpfbp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xrdjb.exec:\xrdjb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\jtptrp.exec:\jtptrp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rnnxtd.exec:\rnnxtd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\flljbnd.exec:\flljbnd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nbpprrl.exec:\nbpprrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ffvdb.exec:\ffvdb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hhlrdb.exec:\hhlrdb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\htpflxf.exec:\htpflxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lttnv.exec:\lttnv.exe17⤵
- Executes dropped EXE
PID:1144 -
\??\c:\flpddb.exec:\flpddb.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fdpjxp.exec:\fdpjxp.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pntjn.exec:\pntjn.exe20⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nbxffjx.exec:\nbxffjx.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vlhjjdf.exec:\vlhjjdf.exe22⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lvltt.exec:\lvltt.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xnlvnxb.exec:\xnlvnxb.exe24⤵
- Executes dropped EXE
PID:808 -
\??\c:\rvhtj.exec:\rvhtj.exe25⤵
- Executes dropped EXE
PID:684 -
\??\c:\vfhdlln.exec:\vfhdlln.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dtvjxnb.exec:\dtvjxnb.exe27⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tjhprx.exec:\tjhprx.exe28⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xfdhf.exec:\xfdhf.exe29⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bxrnvbv.exec:\bxrnvbv.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnxjd.exec:\tnxjd.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tvvlvpt.exec:\tvvlvpt.exe32⤵
- Executes dropped EXE
PID:760 -
\??\c:\dtftjd.exec:\dtftjd.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\jlbnnj.exec:\jlbnnj.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rxbxv.exec:\rxbxv.exe35⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pplnnjr.exec:\pplnnjr.exe36⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hhhjj.exec:\hhhjj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\rhbvn.exec:\rhbvn.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxdptbv.exec:\xxdptbv.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rjthrn.exec:\rjthrn.exe40⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rxdfbbp.exec:\rxdfbbp.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\frhrbj.exec:\frhrbj.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tlrpdt.exec:\tlrpdt.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xvptr.exec:\xvptr.exe44⤵
- Executes dropped EXE
PID:2132 -
\??\c:\trbfxnn.exec:\trbfxnn.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xbphltv.exec:\xbphltv.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ldfbv.exec:\ldfbv.exe47⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jxtpbbn.exec:\jxtpbbn.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\xpnhffv.exec:\xpnhffv.exe49⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tbdvtf.exec:\tbdvtf.exe50⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bjttfbb.exec:\bjttfbb.exe51⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vttpdl.exec:\vttpdl.exe52⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dhbllt.exec:\dhbllt.exe53⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xfrhflt.exec:\xfrhflt.exe54⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dpjvv.exec:\dpjvv.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vhbfh.exec:\vhbfh.exe56⤵
- Executes dropped EXE
PID:1180 -
\??\c:\fhrpxnb.exec:\fhrpxnb.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lbdnl.exec:\lbdnl.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rpjtrv.exec:\rpjtrv.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ppfdnbn.exec:\ppfdnbn.exe60⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nddrj.exec:\nddrj.exe61⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rnxvxx.exec:\rnxvxx.exe62⤵
- Executes dropped EXE
PID:1152 -
\??\c:\djddpth.exec:\djddpth.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ndhltv.exec:\ndhltv.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\bntrxh.exec:\bntrxh.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\fnxvpv.exec:\fnxvpv.exe66⤵PID:2348
-
\??\c:\xxfxt.exec:\xxfxt.exe67⤵PID:2992
-
\??\c:\vtvxr.exec:\vtvxr.exe68⤵PID:904
-
\??\c:\vxvfx.exec:\vxvfx.exe69⤵PID:2972
-
\??\c:\jrblx.exec:\jrblx.exe70⤵PID:1968
-
\??\c:\tjhtpf.exec:\tjhtpf.exe71⤵PID:1676
-
\??\c:\vhtbhd.exec:\vhtbhd.exe72⤵PID:2488
-
\??\c:\hxjnbxh.exec:\hxjnbxh.exe73⤵PID:2908
-
\??\c:\rtrtp.exec:\rtrtp.exe74⤵PID:1704
-
\??\c:\fvtntnr.exec:\fvtntnr.exe75⤵PID:2300
-
\??\c:\vtjbnp.exec:\vtjbnp.exe76⤵PID:1516
-
\??\c:\lrlvndr.exec:\lrlvndr.exe77⤵PID:2772
-
\??\c:\dnvtjv.exec:\dnvtjv.exe78⤵PID:2740
-
\??\c:\lbfjxvn.exec:\lbfjxvn.exe79⤵PID:1464
-
\??\c:\jlvlxdd.exec:\jlvlxdd.exe80⤵PID:2816
-
\??\c:\tnrlhbl.exec:\tnrlhbl.exe81⤵PID:860
-
\??\c:\hdntltt.exec:\hdntltt.exe82⤵PID:2312
-
\??\c:\hndrjt.exec:\hndrjt.exe83⤵PID:752
-
\??\c:\bpfnnn.exec:\bpfnnn.exe84⤵PID:2420
-
\??\c:\dpplnh.exec:\dpplnh.exe85⤵PID:940
-
\??\c:\ldxjxh.exec:\ldxjxh.exe86⤵PID:996
-
\??\c:\ljrtxp.exec:\ljrtxp.exe87⤵PID:1884
-
\??\c:\lbvrp.exec:\lbvrp.exe88⤵PID:3056
-
\??\c:\dvhdrpx.exec:\dvhdrpx.exe89⤵PID:1264
-
\??\c:\jrlrvx.exec:\jrlrvx.exe90⤵PID:2680
-
\??\c:\jvnfj.exec:\jvnfj.exe91⤵PID:1148
-
\??\c:\nvbpl.exec:\nvbpl.exe92⤵PID:2128
-
\??\c:\nljrfj.exec:\nljrfj.exe93⤵PID:2932
-
\??\c:\tdfpd.exec:\tdfpd.exe94⤵PID:2620
-
\??\c:\jdvvfp.exec:\jdvvfp.exe95⤵PID:1196
-
\??\c:\tlxdj.exec:\tlxdj.exe96⤵PID:1044
-
\??\c:\tflrjbl.exec:\tflrjbl.exe97⤵PID:1984
-
\??\c:\hllfl.exec:\hllfl.exe98⤵PID:2280
-
\??\c:\xjrxj.exec:\xjrxj.exe99⤵PID:1180
-
\??\c:\ffrhn.exec:\ffrhn.exe100⤵PID:2320
-
\??\c:\pxfrp.exec:\pxfrp.exe101⤵PID:2156
-
\??\c:\rntlj.exec:\rntlj.exe102⤵PID:2696
-
\??\c:\xlfhth.exec:\xlfhth.exe103⤵PID:2000
-
\??\c:\ftffvp.exec:\ftffvp.exe104⤵PID:1228
-
\??\c:\bvnrnhh.exec:\bvnrnhh.exe105⤵PID:2408
-
\??\c:\rvnrj.exec:\rvnrj.exe106⤵PID:1500
-
\??\c:\fxnxx.exec:\fxnxx.exe107⤵PID:2552
-
\??\c:\jfppbr.exec:\jfppbr.exe108⤵PID:280
-
\??\c:\fvpdfv.exec:\fvpdfv.exe109⤵PID:1716
-
\??\c:\jdhvxnh.exec:\jdhvxnh.exe110⤵PID:1112
-
\??\c:\nnfvjrv.exec:\nnfvjrv.exe111⤵PID:1824
-
\??\c:\jnlxfhn.exec:\jnlxfhn.exe112⤵
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\pbhbl.exec:\pbhbl.exe113⤵PID:1808
-
\??\c:\xhhtnnt.exec:\xhhtnnt.exe114⤵PID:2968
-
\??\c:\jtbndd.exec:\jtbndd.exe115⤵PID:2268
-
\??\c:\llbrlv.exec:\llbrlv.exe116⤵PID:1568
-
\??\c:\vflbt.exec:\vflbt.exe117⤵PID:1704
-
\??\c:\dvvnh.exec:\dvvnh.exe118⤵PID:2300
-
\??\c:\nxrpxhj.exec:\nxrpxhj.exe119⤵PID:2188
-
\??\c:\jxdntpb.exec:\jxdntpb.exe120⤵PID:2776
-
\??\c:\vlfdb.exec:\vlfdb.exe121⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-