Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe
-
Size
456KB
-
MD5
02d29cdad4373336f03468f2ad633585
-
SHA1
1b455198d84c10698df2aa93e47aae9adbbc05a4
-
SHA256
9b0422c8aacaa680ce2a0bf6da06684c099533f4a541d02b17ca4eb4f39d3c4e
-
SHA512
098dd11b81f5966bdae2770cd08ce1c8a374074987b74a0334727e1c3de852f550fd8d8dacf9438e8c722de60ba57644ceb121c494abb2257901e8aad5209b7c
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HsYw80:d7Tc9Wj16A3StvxpL0
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2728-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-219-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/876-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-262-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/836-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-272-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2152-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-372-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2508-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-572-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-759-0x0000000000350000-0x0000000000379000-memory.dmp family_blackmoon behavioral1/memory/956-767-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/352-774-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-944-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-1013-0x0000000000330000-0x0000000000359000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2728 nnbttn.exe 2832 ddvdj.exe 2780 frllxfr.exe 2628 bntnhn.exe 2772 rrfxrlx.exe 2616 ttnbtn.exe 2988 xfrrxxl.exe 1848 5pjvd.exe 2264 7llxlxr.exe 2224 btbntb.exe 1696 5jpdv.exe 1720 lrrrfxf.exe 2424 hnhnnt.exe 1980 jjdjp.exe 2020 rfflxxf.exe 672 tbbtnn.exe 1496 lxlrrxf.exe 2040 hhtntt.exe 2204 pppdp.exe 2100 xxxrfrf.exe 3048 3bnbhn.exe 344 dpvjd.exe 276 hnnbtn.exe 1104 frlxflx.exe 1544 bnthbn.exe 1840 5djdv.exe 876 bbtbnb.exe 2032 3dpdj.exe 836 lfxxlrf.exe 2364 tntnnt.exe 2152 lrxrxxf.exe 2536 ttbtbb.exe 1716 vpddj.exe 2816 3rflrxl.exe 2912 nhbbhn.exe 2908 jpvpp.exe 2704 xxxrlfx.exe 2868 hhbhtb.exe 2712 vvpvv.exe 2624 llxrlfr.exe 2992 1flrfxx.exe 2356 hntnbt.exe 3004 jdvdp.exe 600 flllrxr.exe 1036 jjpvp.exe 2224 pvvvp.exe 1308 lrxfrfx.exe 2508 tttbbh.exe 2424 ppvvv.exe 1908 rlfrxlf.exe 2848 5bbhth.exe 1692 1vppd.exe 2660 1xrrxfr.exe 272 nnthbn.exe 2928 9jjjp.exe 1760 fffxxrx.exe 2192 tbbnht.exe 2472 vvpdj.exe 2500 rrlxlrf.exe 1272 nttbhb.exe 1388 vvpvd.exe 1620 xffffxx.exe 1320 tnttnh.exe 1700 djdvd.exe -
resource yara_rule behavioral1/memory/2728-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/672-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-272-0x00000000003A0000-0x00000000003C9000-memory.dmp upx behavioral1/memory/2152-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-364-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-452-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2472-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-507-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-572-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-648-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-733-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-752-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-774-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-775-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-812-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-820-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-828-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-892-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-944-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-981-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-988-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-1015-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-1082-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2728 2564 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 30 PID 2564 wrote to memory of 2728 2564 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 30 PID 2564 wrote to memory of 2728 2564 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 30 PID 2564 wrote to memory of 2728 2564 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 30 PID 2728 wrote to memory of 2832 2728 nnbttn.exe 31 PID 2728 wrote to memory of 2832 2728 nnbttn.exe 31 PID 2728 wrote to memory of 2832 2728 nnbttn.exe 31 PID 2728 wrote to memory of 2832 2728 nnbttn.exe 31 PID 2832 wrote to memory of 2780 2832 ddvdj.exe 32 PID 2832 wrote to memory of 2780 2832 ddvdj.exe 32 PID 2832 wrote to memory of 2780 2832 ddvdj.exe 32 PID 2832 wrote to memory of 2780 2832 ddvdj.exe 32 PID 2780 wrote to memory of 2628 2780 frllxfr.exe 33 PID 2780 wrote to memory of 2628 2780 frllxfr.exe 33 PID 2780 wrote to memory of 2628 2780 frllxfr.exe 33 PID 2780 wrote to memory of 2628 2780 frllxfr.exe 33 PID 2628 wrote to memory of 2772 2628 bntnhn.exe 34 PID 2628 wrote to memory of 2772 2628 bntnhn.exe 34 PID 2628 wrote to memory of 2772 2628 bntnhn.exe 34 PID 2628 wrote to memory of 2772 2628 bntnhn.exe 34 PID 2772 wrote to memory of 2616 2772 rrfxrlx.exe 35 PID 2772 wrote to memory of 2616 2772 rrfxrlx.exe 35 PID 2772 wrote to memory of 2616 2772 rrfxrlx.exe 35 PID 2772 wrote to memory of 2616 2772 rrfxrlx.exe 35 PID 2616 wrote to memory of 2988 2616 ttnbtn.exe 36 PID 2616 wrote to memory of 2988 2616 ttnbtn.exe 36 PID 2616 wrote to memory of 2988 2616 ttnbtn.exe 36 PID 2616 wrote to memory of 2988 2616 ttnbtn.exe 36 PID 2988 wrote to memory of 1848 2988 xfrrxxl.exe 37 PID 2988 wrote to memory of 1848 2988 xfrrxxl.exe 37 PID 2988 wrote to memory of 1848 2988 xfrrxxl.exe 37 PID 2988 wrote to memory of 1848 2988 xfrrxxl.exe 37 PID 1848 wrote to memory of 2264 1848 5pjvd.exe 38 PID 1848 wrote to memory of 2264 1848 5pjvd.exe 38 PID 1848 wrote to memory of 2264 1848 5pjvd.exe 38 PID 1848 wrote to memory of 2264 1848 5pjvd.exe 38 PID 2264 wrote to memory of 2224 2264 7llxlxr.exe 39 PID 2264 wrote to memory of 2224 2264 7llxlxr.exe 39 PID 2264 wrote to memory of 2224 2264 7llxlxr.exe 39 PID 2264 wrote to memory of 2224 2264 7llxlxr.exe 39 PID 2224 wrote to memory of 1696 2224 btbntb.exe 40 PID 2224 wrote to memory of 1696 2224 btbntb.exe 40 PID 2224 wrote to memory of 1696 2224 btbntb.exe 40 PID 2224 wrote to memory of 1696 2224 btbntb.exe 40 PID 1696 wrote to memory of 1720 1696 5jpdv.exe 41 PID 1696 wrote to memory of 1720 1696 5jpdv.exe 41 PID 1696 wrote to memory of 1720 1696 5jpdv.exe 41 PID 1696 wrote to memory of 1720 1696 5jpdv.exe 41 PID 1720 wrote to memory of 2424 1720 lrrrfxf.exe 42 PID 1720 wrote to memory of 2424 1720 lrrrfxf.exe 42 PID 1720 wrote to memory of 2424 1720 lrrrfxf.exe 42 PID 1720 wrote to memory of 2424 1720 lrrrfxf.exe 42 PID 2424 wrote to memory of 1980 2424 hnhnnt.exe 43 PID 2424 wrote to memory of 1980 2424 hnhnnt.exe 43 PID 2424 wrote to memory of 1980 2424 hnhnnt.exe 43 PID 2424 wrote to memory of 1980 2424 hnhnnt.exe 43 PID 1980 wrote to memory of 2020 1980 jjdjp.exe 44 PID 1980 wrote to memory of 2020 1980 jjdjp.exe 44 PID 1980 wrote to memory of 2020 1980 jjdjp.exe 44 PID 1980 wrote to memory of 2020 1980 jjdjp.exe 44 PID 2020 wrote to memory of 672 2020 rfflxxf.exe 45 PID 2020 wrote to memory of 672 2020 rfflxxf.exe 45 PID 2020 wrote to memory of 672 2020 rfflxxf.exe 45 PID 2020 wrote to memory of 672 2020 rfflxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nnbttn.exec:\nnbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ddvdj.exec:\ddvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\frllxfr.exec:\frllxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bntnhn.exec:\bntnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rrfxrlx.exec:\rrfxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ttnbtn.exec:\ttnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xfrrxxl.exec:\xfrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5pjvd.exec:\5pjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\7llxlxr.exec:\7llxlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\btbntb.exec:\btbntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5jpdv.exec:\5jpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\lrrrfxf.exec:\lrrrfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hnhnnt.exec:\hnhnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jjdjp.exec:\jjdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rfflxxf.exec:\rfflxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\tbbtnn.exec:\tbbtnn.exe17⤵
- Executes dropped EXE
PID:672 -
\??\c:\lxlrrxf.exec:\lxlrrxf.exe18⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hhtntt.exec:\hhtntt.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pppdp.exec:\pppdp.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xxxrfrf.exec:\xxxrfrf.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3bnbhn.exec:\3bnbhn.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dpvjd.exec:\dpvjd.exe23⤵
- Executes dropped EXE
PID:344 -
\??\c:\hnnbtn.exec:\hnnbtn.exe24⤵
- Executes dropped EXE
PID:276 -
\??\c:\frlxflx.exec:\frlxflx.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\bnthbn.exec:\bnthbn.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5djdv.exec:\5djdv.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bbtbnb.exec:\bbtbnb.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\3dpdj.exec:\3dpdj.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe30⤵
- Executes dropped EXE
PID:836 -
\??\c:\tntnnt.exec:\tntnnt.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrxrxxf.exec:\lrxrxxf.exe32⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ttbtbb.exec:\ttbtbb.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vpddj.exec:\vpddj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\3rflrxl.exec:\3rflrxl.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhbbhn.exec:\nhbbhn.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jpvpp.exec:\jpvpp.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhbhtb.exec:\hhbhtb.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvpvv.exec:\vvpvv.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llxrlfr.exec:\llxrlfr.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1flrfxx.exec:\1flrfxx.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hntnbt.exec:\hntnbt.exe43⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jdvdp.exec:\jdvdp.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\flllrxr.exec:\flllrxr.exe45⤵
- Executes dropped EXE
PID:600 -
\??\c:\jjpvp.exec:\jjpvp.exe46⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pvvvp.exec:\pvvvp.exe47⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lrxfrfx.exec:\lrxfrfx.exe48⤵
- Executes dropped EXE
PID:1308 -
\??\c:\tttbbh.exec:\tttbbh.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ppvvv.exec:\ppvvv.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlfrxlf.exec:\rlfrxlf.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5bbhth.exec:\5bbhth.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1vppd.exec:\1vppd.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1xrrxfr.exec:\1xrrxfr.exe54⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nnthbn.exec:\nnthbn.exe55⤵
- Executes dropped EXE
PID:272 -
\??\c:\9jjjp.exec:\9jjjp.exe56⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fffxxrx.exec:\fffxxrx.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tbbnht.exec:\tbbnht.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\vvpdj.exec:\vvpdj.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nttbhb.exec:\nttbhb.exe61⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vvpvd.exec:\vvpvd.exe62⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xffffxx.exec:\xffffxx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\tnttnh.exec:\tnttnh.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\djdvd.exec:\djdvd.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvjpj.exec:\dvjpj.exe66⤵PID:908
-
\??\c:\frrfxrr.exec:\frrfxrr.exe67⤵PID:2956
-
\??\c:\btnbnt.exec:\btnbnt.exe68⤵PID:1904
-
\??\c:\ppjdd.exec:\ppjdd.exe69⤵PID:2064
-
\??\c:\xrrfrfr.exec:\xrrfrfr.exe70⤵PID:1616
-
\??\c:\1bnnnh.exec:\1bnnnh.exe71⤵PID:588
-
\??\c:\jvvdj.exec:\jvvdj.exe72⤵PID:2284
-
\??\c:\5fflfrl.exec:\5fflfrl.exe73⤵PID:2540
-
\??\c:\bhhbhb.exec:\bhhbhb.exe74⤵PID:2744
-
\??\c:\vjpvp.exec:\vjpvp.exe75⤵PID:2740
-
\??\c:\flrrxxl.exec:\flrrxxl.exe76⤵PID:2920
-
\??\c:\nnthnb.exec:\nnthnb.exe77⤵PID:2852
-
\??\c:\ttntnb.exec:\ttntnb.exe78⤵PID:2808
-
\??\c:\dvddd.exec:\dvddd.exe79⤵PID:2824
-
\??\c:\9lrlxfl.exec:\9lrlxfl.exe80⤵PID:2688
-
\??\c:\rrlxflf.exec:\rrlxflf.exe81⤵PID:2768
-
\??\c:\hhhbth.exec:\hhhbth.exe82⤵PID:2712
-
\??\c:\djjjd.exec:\djjjd.exe83⤵PID:2616
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe84⤵PID:1788
-
\??\c:\5bhbtn.exec:\5bhbtn.exe85⤵PID:2244
-
\??\c:\tnttnn.exec:\tnttnn.exe86⤵PID:1848
-
\??\c:\dpddv.exec:\dpddv.exe87⤵PID:2264
-
\??\c:\rrxfxff.exec:\rrxfxff.exe88⤵PID:264
-
\??\c:\nnnhbh.exec:\nnnhbh.exe89⤵PID:1680
-
\??\c:\hnhnhn.exec:\hnhnhn.exe90⤵PID:788
-
\??\c:\1ppvd.exec:\1ppvd.exe91⤵PID:1312
-
\??\c:\9flrlxl.exec:\9flrlxl.exe92⤵PID:1964
-
\??\c:\9tttth.exec:\9tttth.exe93⤵PID:1632
-
\??\c:\nhbbhn.exec:\nhbbhn.exe94⤵PID:1480
-
\??\c:\jjvvd.exec:\jjvvd.exe95⤵PID:1756
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe96⤵PID:2884
-
\??\c:\nthhbn.exec:\nthhbn.exe97⤵PID:1816
-
\??\c:\jdddj.exec:\jdddj.exe98⤵PID:1160
-
\??\c:\llrlxlf.exec:\llrlxlf.exe99⤵PID:2936
-
\??\c:\xllxlfx.exec:\xllxlfx.exe100⤵PID:2200
-
\??\c:\tnbbbb.exec:\tnbbbb.exe101⤵PID:2484
-
\??\c:\5pdjd.exec:\5pdjd.exe102⤵PID:1032
-
\??\c:\flfllfr.exec:\flfllfr.exe103⤵PID:1048
-
\??\c:\fxflrxl.exec:\fxflrxl.exe104⤵PID:1268
-
\??\c:\hnnbbb.exec:\hnnbbb.exe105⤵PID:956
-
\??\c:\flxxlxr.exec:\flxxlxr.exe106⤵PID:352
-
\??\c:\llxfrxl.exec:\llxfrxl.exe107⤵PID:1620
-
\??\c:\tnbnbb.exec:\tnbnbb.exe108⤵PID:1544
-
\??\c:\7jdpv.exec:\7jdpv.exe109⤵PID:1676
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe110⤵PID:848
-
\??\c:\jpdjv.exec:\jpdjv.exe111⤵PID:2388
-
\??\c:\lrxrlrx.exec:\lrxrlrx.exe112⤵PID:1864
-
\??\c:\hhbnbn.exec:\hhbnbn.exe113⤵PID:2556
-
\??\c:\tthtnb.exec:\tthtnb.exe114⤵PID:580
-
\??\c:\pppdp.exec:\pppdp.exe115⤵PID:2784
-
\??\c:\lrrlrrf.exec:\lrrlrrf.exe116⤵PID:2060
-
\??\c:\btnhtb.exec:\btnhtb.exe117⤵PID:1608
-
\??\c:\bttbbb.exec:\bttbbb.exe118⤵PID:2804
-
\??\c:\vpvvj.exec:\vpvvj.exe119⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe120⤵PID:2844
-
\??\c:\bhhnbn.exec:\bhhnbn.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-