Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe
-
Size
419KB
-
MD5
02c27687ebd579e7c03e54637e9de742
-
SHA1
c599702da6e7e634506289b347b40597b7983147
-
SHA256
c728f253c618bae5809011866dc1cf34ff0af6e434251d122e9784671ea191ae
-
SHA512
ef305b2c5759baaa1ec059dffee2e791e38e9cb8238aad345f6c770146546a9184a4fb2026bcebf9e96d2ed14daa6da47d42d819403ba1d7d684796cdd6ff733
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwD7arnDX+X5l5xb:8cm7ImGddXmNt251UriZFwfsDX+XtR
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4816-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-1093-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-1243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3904 bnnbbb.exe 3136 lxlllrr.exe 636 lxxffrf.exe 1260 vvjjp.exe 3704 tntnbb.exe 3708 vpjvv.exe 2012 bhbhtn.exe 1176 vjjdp.exe 4944 fffxxfx.exe 2764 jpvvj.exe 4228 rlfxfff.exe 1880 dvddp.exe 2104 lxxrrxl.exe 2168 5vdvv.exe 4668 lxffxrf.exe 436 nbtttb.exe 4488 jdvjv.exe 4836 xxxrffr.exe 3960 lxllflf.exe 5004 7xrrlxx.exe 4464 htbthb.exe 1064 5jppj.exe 1008 nhbbnh.exe 968 ddddv.exe 4880 lxfffxx.exe 4936 btbtnh.exe 1544 ddpvd.exe 64 tthhnn.exe 3064 pvpvd.exe 4316 bhnttt.exe 4384 rfxfrfl.exe 2744 thnbbn.exe 4364 lxxrflf.exe 2520 lflllll.exe 4564 nnnbhb.exe 4576 jdjdv.exe 4288 jvpvj.exe 3176 xxxlxfx.exe 2924 tttbht.exe 4148 pjdvp.exe 4044 rfxrffl.exe 4848 9nnnhb.exe 4852 pdvvp.exe 3036 rlxxxxr.exe 3028 nhnnbb.exe 3280 vppjj.exe 2144 rrlrrrl.exe 784 3hnnhn.exe 392 3nbhnn.exe 2684 pppdv.exe 1284 htbhhn.exe 4228 3ppvj.exe 3884 rrxlffx.exe 1880 thbnbn.exe 5016 vppjd.exe 1920 xxxxrlr.exe 3768 btnhbb.exe 1876 5vdvd.exe 836 jddvv.exe 5096 xrfrxrl.exe 2936 dvppj.exe 3568 jppjj.exe 4692 fxflfrx.exe 4792 hhbnbb.exe -
resource yara_rule behavioral2/memory/4816-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-444-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3904 4816 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 84 PID 4816 wrote to memory of 3904 4816 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 84 PID 4816 wrote to memory of 3904 4816 02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe 84 PID 3904 wrote to memory of 3136 3904 bnnbbb.exe 86 PID 3904 wrote to memory of 3136 3904 bnnbbb.exe 86 PID 3904 wrote to memory of 3136 3904 bnnbbb.exe 86 PID 3136 wrote to memory of 636 3136 lxlllrr.exe 87 PID 3136 wrote to memory of 636 3136 lxlllrr.exe 87 PID 3136 wrote to memory of 636 3136 lxlllrr.exe 87 PID 636 wrote to memory of 1260 636 lxxffrf.exe 88 PID 636 wrote to memory of 1260 636 lxxffrf.exe 88 PID 636 wrote to memory of 1260 636 lxxffrf.exe 88 PID 1260 wrote to memory of 3704 1260 vvjjp.exe 89 PID 1260 wrote to memory of 3704 1260 vvjjp.exe 89 PID 1260 wrote to memory of 3704 1260 vvjjp.exe 89 PID 3704 wrote to memory of 3708 3704 tntnbb.exe 90 PID 3704 wrote to memory of 3708 3704 tntnbb.exe 90 PID 3704 wrote to memory of 3708 3704 tntnbb.exe 90 PID 3708 wrote to memory of 2012 3708 vpjvv.exe 91 PID 3708 wrote to memory of 2012 3708 vpjvv.exe 91 PID 3708 wrote to memory of 2012 3708 vpjvv.exe 91 PID 2012 wrote to memory of 1176 2012 bhbhtn.exe 92 PID 2012 wrote to memory of 1176 2012 bhbhtn.exe 92 PID 2012 wrote to memory of 1176 2012 bhbhtn.exe 92 PID 1176 wrote to memory of 4944 1176 vjjdp.exe 95 PID 1176 wrote to memory of 4944 1176 vjjdp.exe 95 PID 1176 wrote to memory of 4944 1176 vjjdp.exe 95 PID 4944 wrote to memory of 2764 4944 fffxxfx.exe 96 PID 4944 wrote to memory of 2764 4944 fffxxfx.exe 96 PID 4944 wrote to memory of 2764 4944 fffxxfx.exe 96 PID 2764 wrote to memory of 4228 2764 jpvvj.exe 97 PID 2764 wrote to memory of 4228 2764 jpvvj.exe 97 PID 2764 wrote to memory of 4228 2764 jpvvj.exe 97 PID 4228 wrote to memory of 1880 4228 rlfxfff.exe 98 PID 4228 wrote to memory of 1880 4228 rlfxfff.exe 98 PID 4228 wrote to memory of 1880 4228 rlfxfff.exe 98 PID 1880 wrote to memory of 2104 1880 dvddp.exe 99 PID 1880 wrote to memory of 2104 1880 dvddp.exe 99 PID 1880 wrote to memory of 2104 1880 dvddp.exe 99 PID 2104 wrote to memory of 2168 2104 lxxrrxl.exe 100 PID 2104 wrote to memory of 2168 2104 lxxrrxl.exe 100 PID 2104 wrote to memory of 2168 2104 lxxrrxl.exe 100 PID 2168 wrote to memory of 4668 2168 5vdvv.exe 101 PID 2168 wrote to memory of 4668 2168 5vdvv.exe 101 PID 2168 wrote to memory of 4668 2168 5vdvv.exe 101 PID 4668 wrote to memory of 436 4668 lxffxrf.exe 102 PID 4668 wrote to memory of 436 4668 lxffxrf.exe 102 PID 4668 wrote to memory of 436 4668 lxffxrf.exe 102 PID 436 wrote to memory of 4488 436 nbtttb.exe 104 PID 436 wrote to memory of 4488 436 nbtttb.exe 104 PID 436 wrote to memory of 4488 436 nbtttb.exe 104 PID 4488 wrote to memory of 4836 4488 jdvjv.exe 105 PID 4488 wrote to memory of 4836 4488 jdvjv.exe 105 PID 4488 wrote to memory of 4836 4488 jdvjv.exe 105 PID 4836 wrote to memory of 3960 4836 xxxrffr.exe 106 PID 4836 wrote to memory of 3960 4836 xxxrffr.exe 106 PID 4836 wrote to memory of 3960 4836 xxxrffr.exe 106 PID 3960 wrote to memory of 5004 3960 lxllflf.exe 107 PID 3960 wrote to memory of 5004 3960 lxllflf.exe 107 PID 3960 wrote to memory of 5004 3960 lxllflf.exe 107 PID 5004 wrote to memory of 4464 5004 7xrrlxx.exe 108 PID 5004 wrote to memory of 4464 5004 7xrrlxx.exe 108 PID 5004 wrote to memory of 4464 5004 7xrrlxx.exe 108 PID 4464 wrote to memory of 1064 4464 htbthb.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02c27687ebd579e7c03e54637e9de742_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\bnnbbb.exec:\bnnbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\lxlllrr.exec:\lxlllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\lxxffrf.exec:\lxxffrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\vvjjp.exec:\vvjjp.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\tntnbb.exec:\tntnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vpjvv.exec:\vpjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\bhbhtn.exec:\bhbhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vjjdp.exec:\vjjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\fffxxfx.exec:\fffxxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\jpvvj.exec:\jpvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlfxfff.exec:\rlfxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\dvddp.exec:\dvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\lxxrrxl.exec:\lxxrrxl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5vdvv.exec:\5vdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lxffxrf.exec:\lxffxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\nbtttb.exec:\nbtttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\jdvjv.exec:\jdvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\xxxrffr.exec:\xxxrffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\lxllflf.exec:\lxllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\7xrrlxx.exec:\7xrrlxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\htbthb.exec:\htbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\5jppj.exec:\5jppj.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nhbbnh.exec:\nhbbnh.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ddddv.exec:\ddddv.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\lxfffxx.exec:\lxfffxx.exe26⤵
- Executes dropped EXE
PID:4880 -
\??\c:\btbtnh.exec:\btbtnh.exe27⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ddpvd.exec:\ddpvd.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tthhnn.exec:\tthhnn.exe29⤵
- Executes dropped EXE
PID:64 -
\??\c:\pvpvd.exec:\pvpvd.exe30⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bhnttt.exec:\bhnttt.exe31⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rfxfrfl.exec:\rfxfrfl.exe32⤵
- Executes dropped EXE
PID:4384 -
\??\c:\thnbbn.exec:\thnbbn.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lxxrflf.exec:\lxxrflf.exe34⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lflllll.exec:\lflllll.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nnnbhb.exec:\nnnbhb.exe36⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jdjdv.exec:\jdjdv.exe37⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jvpvj.exec:\jvpvj.exe38⤵
- Executes dropped EXE
PID:4288 -
\??\c:\xxxlxfx.exec:\xxxlxfx.exe39⤵
- Executes dropped EXE
PID:3176 -
\??\c:\tttbht.exec:\tttbht.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjdvp.exec:\pjdvp.exe41⤵
- Executes dropped EXE
PID:4148 -
\??\c:\rfxrffl.exec:\rfxrffl.exe42⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9nnnhb.exec:\9nnnhb.exe43⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pdvvp.exec:\pdvvp.exe44⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe45⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhnnbb.exec:\nhnnbb.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vppjj.exec:\vppjj.exe47⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\3hnnhn.exec:\3hnnhn.exe49⤵
- Executes dropped EXE
PID:784 -
\??\c:\3nbhnn.exec:\3nbhnn.exe50⤵
- Executes dropped EXE
PID:392 -
\??\c:\pppdv.exec:\pppdv.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\htbhhn.exec:\htbhhn.exe52⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3ppvj.exec:\3ppvj.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\rrxlffx.exec:\rrxlffx.exe54⤵
- Executes dropped EXE
PID:3884 -
\??\c:\thbnbn.exec:\thbnbn.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vppjd.exec:\vppjd.exe56⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xxxxrlr.exec:\xxxxrlr.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btnhbb.exec:\btnhbb.exe58⤵
- Executes dropped EXE
PID:3768 -
\??\c:\5vdvd.exec:\5vdvd.exe59⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jddvv.exec:\jddvv.exe60⤵
- Executes dropped EXE
PID:836 -
\??\c:\xrfrxrl.exec:\xrfrxrl.exe61⤵
- Executes dropped EXE
PID:5096 -
\??\c:\dvppj.exec:\dvppj.exe62⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jppjj.exec:\jppjj.exe63⤵
- Executes dropped EXE
PID:3568 -
\??\c:\fxflfrx.exec:\fxflfrx.exe64⤵
- Executes dropped EXE
PID:4692 -
\??\c:\hhbnbb.exec:\hhbnbb.exe65⤵
- Executes dropped EXE
PID:4792 -
\??\c:\dvjjv.exec:\dvjjv.exe66⤵PID:3956
-
\??\c:\7jjdv.exec:\7jjdv.exe67⤵PID:4180
-
\??\c:\xlrrxlr.exec:\xlrrxlr.exe68⤵PID:2844
-
\??\c:\bbnbht.exec:\bbnbht.exe69⤵PID:1372
-
\??\c:\pdvdj.exec:\pdvdj.exe70⤵PID:4440
-
\??\c:\lllxrlx.exec:\lllxrlx.exe71⤵PID:3252
-
\??\c:\nntthh.exec:\nntthh.exe72⤵
- System Location Discovery: System Language Discovery
PID:4796 -
\??\c:\5vddj.exec:\5vddj.exe73⤵PID:2940
-
\??\c:\vpddd.exec:\vpddd.exe74⤵PID:2536
-
\??\c:\lfffffl.exec:\lfffffl.exe75⤵PID:1388
-
\??\c:\bbbnbt.exec:\bbbnbt.exe76⤵PID:2780
-
\??\c:\ddpjj.exec:\ddpjj.exe77⤵PID:4908
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe78⤵PID:3064
-
\??\c:\bhhhbh.exec:\bhhhbh.exe79⤵PID:4452
-
\??\c:\dvddv.exec:\dvddv.exe80⤵PID:2872
-
\??\c:\pvvpj.exec:\pvvpj.exe81⤵PID:4172
-
\??\c:\xlfrfrf.exec:\xlfrfrf.exe82⤵PID:4540
-
\??\c:\nthtnn.exec:\nthtnn.exe83⤵PID:1132
-
\??\c:\jjpjj.exec:\jjpjj.exe84⤵PID:2096
-
\??\c:\djvvp.exec:\djvvp.exe85⤵PID:4816
-
\??\c:\xxrfrff.exec:\xxrfrff.exe86⤵PID:860
-
\??\c:\hbtbtn.exec:\hbtbtn.exe87⤵PID:3136
-
\??\c:\jdddd.exec:\jdddd.exe88⤵PID:4732
-
\??\c:\ffrlxrr.exec:\ffrlxrr.exe89⤵PID:3628
-
\??\c:\nbnnbt.exec:\nbnnbt.exe90⤵PID:628
-
\??\c:\flffxxr.exec:\flffxxr.exe91⤵PID:4848
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe92⤵PID:4688
-
\??\c:\ttbtnn.exec:\ttbtnn.exe93⤵PID:3240
-
\??\c:\jvdvv.exec:\jvdvv.exe94⤵PID:3808
-
\??\c:\1rxxllf.exec:\1rxxllf.exe95⤵PID:3552
-
\??\c:\httbth.exec:\httbth.exe96⤵PID:4496
-
\??\c:\dddvv.exec:\dddvv.exe97⤵PID:116
-
\??\c:\xrffxrl.exec:\xrffxrl.exe98⤵PID:4448
-
\??\c:\bbtttb.exec:\bbtttb.exe99⤵PID:3044
-
\??\c:\ntbbth.exec:\ntbbth.exe100⤵PID:4084
-
\??\c:\jjjdv.exec:\jjjdv.exe101⤵PID:5008
-
\??\c:\lfxlxxr.exec:\lfxlxxr.exe102⤵PID:2104
-
\??\c:\hntbbh.exec:\hntbbh.exe103⤵PID:3484
-
\??\c:\bnnnhb.exec:\bnnnhb.exe104⤵PID:996
-
\??\c:\1vjjj.exec:\1vjjj.exe105⤵PID:1552
-
\??\c:\llxrfrx.exec:\llxrfrx.exe106⤵PID:1232
-
\??\c:\btntbh.exec:\btntbh.exe107⤵PID:1876
-
\??\c:\bhtnhh.exec:\bhtnhh.exe108⤵PID:1812
-
\??\c:\ddvpj.exec:\ddvpj.exe109⤵PID:4360
-
\??\c:\xllrlrr.exec:\xllrlrr.exe110⤵PID:1488
-
\??\c:\tnbbth.exec:\tnbbth.exe111⤵PID:3960
-
\??\c:\dvvvj.exec:\dvvvj.exe112⤵PID:536
-
\??\c:\llrxrrr.exec:\llrxrrr.exe113⤵PID:2432
-
\??\c:\llflllx.exec:\llflllx.exe114⤵PID:3988
-
\??\c:\htbtnn.exec:\htbtnn.exe115⤵PID:4768
-
\??\c:\ddvvj.exec:\ddvvj.exe116⤵PID:732
-
\??\c:\lllfxxr.exec:\lllfxxr.exe117⤵PID:3184
-
\??\c:\xffxxxr.exec:\xffxxxr.exe118⤵PID:1340
-
\??\c:\hnbtnh.exec:\hnbtnh.exe119⤵PID:4640
-
\??\c:\pjdpp.exec:\pjdpp.exe120⤵PID:512
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe121⤵PID:4736
-
\??\c:\hbbhtb.exec:\hbbhtb.exe122⤵PID:868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-