Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe
-
Size
456KB
-
MD5
02d29cdad4373336f03468f2ad633585
-
SHA1
1b455198d84c10698df2aa93e47aae9adbbc05a4
-
SHA256
9b0422c8aacaa680ce2a0bf6da06684c099533f4a541d02b17ca4eb4f39d3c4e
-
SHA512
098dd11b81f5966bdae2770cd08ce1c8a374074987b74a0334727e1c3de852f550fd8d8dacf9438e8c722de60ba57644ceb121c494abb2257901e8aad5209b7c
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HsYw80:d7Tc9Wj16A3StvxpL0
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4864-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-476-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-560-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-649-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-546-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-538-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-518-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-698-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-718-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 9rlffff.exe 2700 rllfxrr.exe 5100 bhtnnt.exe 4056 vdppv.exe 312 flllfll.exe 1824 hhtnbb.exe 5020 vpjdd.exe 4500 jdjdv.exe 4776 fxffffx.exe 208 7jpjp.exe 1488 pvdvp.exe 1664 1lrlffx.exe 4836 nthtbt.exe 1192 rflfxxr.exe 4172 bhbtht.exe 1756 tbhhbb.exe 2888 vpjdp.exe 4032 tbtttb.exe 3564 jpdjj.exe 5000 9hnhhh.exe 4700 ppvvp.exe 60 fxfxxrf.exe 3704 tttbtb.exe 1212 jvjjj.exe 3192 llfxxrr.exe 4140 hbnhtt.exe 624 jdjdv.exe 3276 rrffxrr.exe 4572 bhnnnn.exe 1404 ntnhtt.exe 1484 dvddj.exe 4144 hnhhth.exe 4556 pvvvp.exe 2340 ppvpj.exe 4436 bbbttt.exe 4952 jppjj.exe 2672 lxxxxxx.exe 3308 tnnnnn.exe 1612 ppvpp.exe 4780 llrfflx.exe 2028 7dvvp.exe 5016 pvpjj.exe 2524 lffxffx.exe 1468 hnnnhh.exe 3560 pdpdj.exe 4776 rfxxlxl.exe 208 thhbbt.exe 1488 dvdvv.exe 2232 pppjj.exe 1568 xlllrxf.exe 4708 7ntnhh.exe 3544 3dvvp.exe 4276 1llllxl.exe 5024 lffxrrr.exe 1208 bntnhb.exe 4728 jddvv.exe 2376 jpdvv.exe 2888 rflfrrr.exe 4032 thhbnh.exe 3444 hhbbbb.exe 5000 vvvvp.exe 1072 lxfrlfl.exe 1216 htntnh.exe 2792 pjjdj.exe -
resource yara_rule behavioral2/memory/4864-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-476-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-586-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-645-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-649-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-546-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-518-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-486-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-468-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-434-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-284-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1292 4864 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 84 PID 4864 wrote to memory of 1292 4864 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 84 PID 4864 wrote to memory of 1292 4864 02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe 84 PID 1292 wrote to memory of 2700 1292 9rlffff.exe 85 PID 1292 wrote to memory of 2700 1292 9rlffff.exe 85 PID 1292 wrote to memory of 2700 1292 9rlffff.exe 85 PID 2700 wrote to memory of 5100 2700 rllfxrr.exe 86 PID 2700 wrote to memory of 5100 2700 rllfxrr.exe 86 PID 2700 wrote to memory of 5100 2700 rllfxrr.exe 86 PID 5100 wrote to memory of 4056 5100 bhtnnt.exe 87 PID 5100 wrote to memory of 4056 5100 bhtnnt.exe 87 PID 5100 wrote to memory of 4056 5100 bhtnnt.exe 87 PID 4056 wrote to memory of 312 4056 vdppv.exe 88 PID 4056 wrote to memory of 312 4056 vdppv.exe 88 PID 4056 wrote to memory of 312 4056 vdppv.exe 88 PID 312 wrote to memory of 1824 312 flllfll.exe 89 PID 312 wrote to memory of 1824 312 flllfll.exe 89 PID 312 wrote to memory of 1824 312 flllfll.exe 89 PID 1824 wrote to memory of 5020 1824 hhtnbb.exe 171 PID 1824 wrote to memory of 5020 1824 hhtnbb.exe 171 PID 1824 wrote to memory of 5020 1824 hhtnbb.exe 171 PID 5020 wrote to memory of 4500 5020 vpjdd.exe 92 PID 5020 wrote to memory of 4500 5020 vpjdd.exe 92 PID 5020 wrote to memory of 4500 5020 vpjdd.exe 92 PID 4500 wrote to memory of 4776 4500 jdjdv.exe 93 PID 4500 wrote to memory of 4776 4500 jdjdv.exe 93 PID 4500 wrote to memory of 4776 4500 jdjdv.exe 93 PID 4776 wrote to memory of 208 4776 fxffffx.exe 95 PID 4776 wrote to memory of 208 4776 fxffffx.exe 95 PID 4776 wrote to memory of 208 4776 fxffffx.exe 95 PID 208 wrote to memory of 1488 208 7jpjp.exe 96 PID 208 wrote to memory of 1488 208 7jpjp.exe 96 PID 208 wrote to memory of 1488 208 7jpjp.exe 96 PID 1488 wrote to memory of 1664 1488 pvdvp.exe 97 PID 1488 wrote to memory of 1664 1488 pvdvp.exe 97 PID 1488 wrote to memory of 1664 1488 pvdvp.exe 97 PID 1664 wrote to memory of 4836 1664 1lrlffx.exe 98 PID 1664 wrote to memory of 4836 1664 1lrlffx.exe 98 PID 1664 wrote to memory of 4836 1664 1lrlffx.exe 98 PID 4836 wrote to memory of 1192 4836 nthtbt.exe 259 PID 4836 wrote to memory of 1192 4836 nthtbt.exe 259 PID 4836 wrote to memory of 1192 4836 nthtbt.exe 259 PID 1192 wrote to memory of 4172 1192 rflfxxr.exe 101 PID 1192 wrote to memory of 4172 1192 rflfxxr.exe 101 PID 1192 wrote to memory of 4172 1192 rflfxxr.exe 101 PID 4172 wrote to memory of 1756 4172 bhbtht.exe 267 PID 4172 wrote to memory of 1756 4172 bhbtht.exe 267 PID 4172 wrote to memory of 1756 4172 bhbtht.exe 267 PID 1756 wrote to memory of 2888 1756 tbhhbb.exe 103 PID 1756 wrote to memory of 2888 1756 tbhhbb.exe 103 PID 1756 wrote to memory of 2888 1756 tbhhbb.exe 103 PID 2888 wrote to memory of 4032 2888 vpjdp.exe 104 PID 2888 wrote to memory of 4032 2888 vpjdp.exe 104 PID 2888 wrote to memory of 4032 2888 vpjdp.exe 104 PID 4032 wrote to memory of 3564 4032 tbtttb.exe 105 PID 4032 wrote to memory of 3564 4032 tbtttb.exe 105 PID 4032 wrote to memory of 3564 4032 tbtttb.exe 105 PID 3564 wrote to memory of 5000 3564 jpdjj.exe 106 PID 3564 wrote to memory of 5000 3564 jpdjj.exe 106 PID 3564 wrote to memory of 5000 3564 jpdjj.exe 106 PID 5000 wrote to memory of 4700 5000 9hnhhh.exe 107 PID 5000 wrote to memory of 4700 5000 9hnhhh.exe 107 PID 5000 wrote to memory of 4700 5000 9hnhhh.exe 107 PID 4700 wrote to memory of 60 4700 ppvvp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02d29cdad4373336f03468f2ad633585_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9rlffff.exec:\9rlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rllfxrr.exec:\rllfxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bhtnnt.exec:\bhtnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\vdppv.exec:\vdppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\flllfll.exec:\flllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\hhtnbb.exec:\hhtnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\vpjdd.exec:\vpjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\jdjdv.exec:\jdjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\fxffffx.exec:\fxffffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\7jpjp.exec:\7jpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\pvdvp.exec:\pvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\1lrlffx.exec:\1lrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nthtbt.exec:\nthtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\rflfxxr.exec:\rflfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\bhbtht.exec:\bhbtht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\tbhhbb.exec:\tbhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\vpjdp.exec:\vpjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tbtttb.exec:\tbtttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\jpdjj.exec:\jpdjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\9hnhhh.exec:\9hnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\ppvvp.exec:\ppvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe23⤵
- Executes dropped EXE
PID:60 -
\??\c:\tttbtb.exec:\tttbtb.exe24⤵
- Executes dropped EXE
PID:3704 -
\??\c:\jvjjj.exec:\jvjjj.exe25⤵
- Executes dropped EXE
PID:1212 -
\??\c:\llfxxrr.exec:\llfxxrr.exe26⤵
- Executes dropped EXE
PID:3192 -
\??\c:\hbnhtt.exec:\hbnhtt.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\jdjdv.exec:\jdjdv.exe28⤵
- Executes dropped EXE
PID:624 -
\??\c:\rrffxrr.exec:\rrffxrr.exe29⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bhnnnn.exec:\bhnnnn.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\ntnhtt.exec:\ntnhtt.exe31⤵
- Executes dropped EXE
PID:1404 -
\??\c:\dvddj.exec:\dvddj.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hnhhth.exec:\hnhhth.exe33⤵
- Executes dropped EXE
PID:4144 -
\??\c:\pvvvp.exec:\pvvvp.exe34⤵
- Executes dropped EXE
PID:4556 -
\??\c:\ppvpj.exec:\ppvpj.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bbbttt.exec:\bbbttt.exe36⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jppjj.exec:\jppjj.exe37⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnnnnn.exec:\tnnnnn.exe39⤵
- Executes dropped EXE
PID:3308 -
\??\c:\ppvpp.exec:\ppvpp.exe40⤵
- Executes dropped EXE
PID:1612 -
\??\c:\llrfflx.exec:\llrfflx.exe41⤵
- Executes dropped EXE
PID:4780 -
\??\c:\7dvvp.exec:\7dvvp.exe42⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvpjj.exec:\pvpjj.exe43⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lffxffx.exec:\lffxffx.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hnnnhh.exec:\hnnnhh.exe45⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pdpdj.exec:\pdpdj.exe46⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rfxxlxl.exec:\rfxxlxl.exe47⤵
- Executes dropped EXE
PID:4776 -
\??\c:\thhbbt.exec:\thhbbt.exe48⤵
- Executes dropped EXE
PID:208 -
\??\c:\dvdvv.exec:\dvdvv.exe49⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pppjj.exec:\pppjj.exe50⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xlllrxf.exec:\xlllrxf.exe51⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7ntnhh.exec:\7ntnhh.exe52⤵
- Executes dropped EXE
PID:4708 -
\??\c:\3dvvp.exec:\3dvvp.exe53⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1llllxl.exec:\1llllxl.exe54⤵
- Executes dropped EXE
PID:4276 -
\??\c:\lffxrrr.exec:\lffxrrr.exe55⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bntnhb.exec:\bntnhb.exe56⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jddvv.exec:\jddvv.exe57⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jpdvv.exec:\jpdvv.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rflfrrr.exec:\rflfrrr.exe59⤵
- Executes dropped EXE
PID:2888 -
\??\c:\thhbnh.exec:\thhbnh.exe60⤵
- Executes dropped EXE
PID:4032 -
\??\c:\hhbbbb.exec:\hhbbbb.exe61⤵
- Executes dropped EXE
PID:3444 -
\??\c:\vvvvp.exec:\vvvvp.exe62⤵
- Executes dropped EXE
PID:5000 -
\??\c:\lxfrlfl.exec:\lxfrlfl.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\htntnh.exec:\htntnh.exe64⤵
- Executes dropped EXE
PID:1216 -
\??\c:\pjjdj.exec:\pjjdj.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ppjjd.exec:\ppjjd.exe66⤵PID:3880
-
\??\c:\9rxxlll.exec:\9rxxlll.exe67⤵PID:1820
-
\??\c:\nbtnbt.exec:\nbtnbt.exe68⤵PID:4076
-
\??\c:\hbthnt.exec:\hbthnt.exe69⤵PID:3640
-
\??\c:\3dpjv.exec:\3dpjv.exe70⤵PID:4948
-
\??\c:\3fxrllf.exec:\3fxrllf.exe71⤵PID:4468
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe72⤵PID:4784
-
\??\c:\btnhtt.exec:\btnhtt.exe73⤵PID:2064
-
\??\c:\pjjjd.exec:\pjjjd.exe74⤵PID:4204
-
\??\c:\3ffxrfl.exec:\3ffxrfl.exe75⤵PID:1484
-
\??\c:\xlrllll.exec:\xlrllll.exe76⤵PID:3912
-
\??\c:\tthbhh.exec:\tthbhh.exe77⤵
- System Location Discovery: System Language Discovery
PID:4464 -
\??\c:\frxlffx.exec:\frxlffx.exe78⤵PID:896
-
\??\c:\xlllrll.exec:\xlllrll.exe79⤵PID:2448
-
\??\c:\bhhbhb.exec:\bhhbhb.exe80⤵
- System Location Discovery: System Language Discovery
PID:4952 -
\??\c:\pdjdv.exec:\pdjdv.exe81⤵PID:3788
-
\??\c:\djvdp.exec:\djvdp.exe82⤵PID:4072
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe83⤵PID:880
-
\??\c:\hbtnnh.exec:\hbtnnh.exe84⤵PID:2824
-
\??\c:\3jvvp.exec:\3jvvp.exe85⤵PID:4104
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe86⤵PID:5020
-
\??\c:\9xrlfxx.exec:\9xrlfxx.exe87⤵PID:4384
-
\??\c:\5hbtnh.exec:\5hbtnh.exe88⤵PID:2524
-
\??\c:\7pvdd.exec:\7pvdd.exe89⤵PID:3712
-
\??\c:\dpvdv.exec:\dpvdv.exe90⤵PID:2576
-
\??\c:\5lxxflf.exec:\5lxxflf.exe91⤵PID:4916
-
\??\c:\ttnnbh.exec:\ttnnbh.exe92⤵PID:3616
-
\??\c:\ddvjd.exec:\ddvjd.exe93⤵PID:4324
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe94⤵PID:4604
-
\??\c:\rfrlrrl.exec:\rfrlrrl.exe95⤵PID:2972
-
\??\c:\5ntttn.exec:\5ntttn.exe96⤵PID:1880
-
\??\c:\vvppp.exec:\vvppp.exe97⤵PID:612
-
\??\c:\xxrrlll.exec:\xxrrlll.exe98⤵PID:1016
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe99⤵PID:4832
-
\??\c:\hhtnht.exec:\hhtnht.exe100⤵PID:4532
-
\??\c:\jvddd.exec:\jvddd.exe101⤵PID:4760
-
\??\c:\flxxxfl.exec:\flxxxfl.exe102⤵PID:3752
-
\??\c:\xxlrlff.exec:\xxlrlff.exe103⤵PID:5116
-
\??\c:\3hbttt.exec:\3hbttt.exe104⤵PID:1168
-
\??\c:\pvpvj.exec:\pvpvj.exe105⤵PID:2332
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe106⤵PID:4140
-
\??\c:\9httnt.exec:\9httnt.exe107⤵PID:548
-
\??\c:\bntnhn.exec:\bntnhn.exe108⤵PID:872
-
\??\c:\pvdjj.exec:\pvdjj.exe109⤵PID:2088
-
\??\c:\7rrrfll.exec:\7rrrfll.exe110⤵PID:2488
-
\??\c:\rrxrrxf.exec:\rrxrrxf.exe111⤵PID:4516
-
\??\c:\tnttnt.exec:\tnttnt.exe112⤵PID:1484
-
\??\c:\7ddvv.exec:\7ddvv.exe113⤵PID:3912
-
\??\c:\5fxxxxr.exec:\5fxxxxr.exe114⤵PID:4436
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe115⤵PID:896
-
\??\c:\ttnnnt.exec:\ttnnnt.exe116⤵PID:1784
-
\??\c:\vpdvv.exec:\vpdvv.exe117⤵PID:4952
-
\??\c:\5lrllll.exec:\5lrllll.exe118⤵PID:3788
-
\??\c:\tnhbtt.exec:\tnhbtt.exe119⤵PID:4072
-
\??\c:\vjvpp.exec:\vjvpp.exe120⤵PID:3528
-
\??\c:\jvjvv.exec:\jvjvv.exe121⤵PID:2876
-
\??\c:\xffllrx.exec:\xffllrx.exe122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-