Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 23:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe
-
Size
457KB
-
MD5
02f45a3d77ea7020705f910c5135be9b
-
SHA1
0c1bf1c647830cd631897db58e3df42ec4772d99
-
SHA256
4862c022813c7af4ed293d6108c0acc46cdb74b531faab36ea27bb33e175e22f
-
SHA512
c7a7c0f052aab2df36590989f3e5f2e6f28df7ce7890b753a7dc9859cdcb1f59110b37214bb763ba4111a1f1e64ecbd0aab6691738948890499764dfd9553c30
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hssto:d7Tc9Wj16A3Stvxg
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2004-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-594-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-1146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-1307-0x00000000003D0000-0x00000000003F9000-memory.dmp family_blackmoon behavioral1/memory/2248-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-672-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1128-665-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-664-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-630-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1688-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-62-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 rrlrrxl.exe 2192 9rflrxl.exe 1212 5bbhbb.exe 2700 5jjdv.exe 2812 xxrxflf.exe 2764 hnhthn.exe 2724 ddddp.exe 2628 jvpjj.exe 2652 fllxlxl.exe 1252 thhbtt.exe 3008 5jdvv.exe 764 pdddp.exe 1688 tnbbnb.exe 2848 9fflrrf.exe 1632 1nhbnt.exe 948 1ddjv.exe 2708 9fxfxfl.exe 1644 tbbbth.exe 1820 3pjpd.exe 2112 llrffxx.exe 2272 nhbhbb.exe 2208 ddvjj.exe 2108 rxxlfxr.exe 2028 nthtnt.exe 1044 pjpvp.exe 1680 xlfxrlx.exe 844 nnntht.exe 3048 rxxfrrx.exe 1824 7nbbbn.exe 696 pjjvv.exe 2920 rxrfrfx.exe 1788 hbbbhb.exe 2692 pvvpd.exe 1768 llxrfrl.exe 2284 nnhbtn.exe 2192 dvvvj.exe 2328 rrrlflx.exe 2824 htbbhh.exe 2732 jjjpj.exe 2796 ppvpd.exe 2872 tnbtnb.exe 2792 9hhtht.exe 2660 5jjjd.exe 2656 rrrfrrl.exe 2648 3hhnnt.exe 668 hhnbbn.exe 2008 7jjdp.exe 3044 1fxlxfl.exe 1688 dvpvj.exe 264 1vvpp.exe 2880 lllxxrl.exe 1488 bhnhnn.exe 2900 hhthbn.exe 2216 5ddpd.exe 2708 rffrlfl.exe 2052 rrlxrfl.exe 2104 tnbnhn.exe 1180 1vvpj.exe 536 9pjvv.exe 908 lxfffxx.exe 2108 tnntbh.exe 1540 bbbtnb.exe 1348 jvjjj.exe 1752 rxxrfxf.exe -
resource yara_rule behavioral1/memory/2004-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-519-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-637-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-657-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-691-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-855-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-875-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-1127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-1146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-1171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-1215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-1246-0x0000000000430000-0x0000000000459000-memory.dmp upx behavioral1/memory/1556-1375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-1012-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-963-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-862-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-842-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-780-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-712-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-705-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-698-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-665-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-664-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-650-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-539-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-27-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2004 2692 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2004 2692 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2004 2692 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2004 2692 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 30 PID 2004 wrote to memory of 2192 2004 rrlrrxl.exe 31 PID 2004 wrote to memory of 2192 2004 rrlrrxl.exe 31 PID 2004 wrote to memory of 2192 2004 rrlrrxl.exe 31 PID 2004 wrote to memory of 2192 2004 rrlrrxl.exe 31 PID 2192 wrote to memory of 1212 2192 9rflrxl.exe 237 PID 2192 wrote to memory of 1212 2192 9rflrxl.exe 237 PID 2192 wrote to memory of 1212 2192 9rflrxl.exe 237 PID 2192 wrote to memory of 1212 2192 9rflrxl.exe 237 PID 1212 wrote to memory of 2700 1212 5bbhbb.exe 33 PID 1212 wrote to memory of 2700 1212 5bbhbb.exe 33 PID 1212 wrote to memory of 2700 1212 5bbhbb.exe 33 PID 1212 wrote to memory of 2700 1212 5bbhbb.exe 33 PID 2700 wrote to memory of 2812 2700 5jjdv.exe 205 PID 2700 wrote to memory of 2812 2700 5jjdv.exe 205 PID 2700 wrote to memory of 2812 2700 5jjdv.exe 205 PID 2700 wrote to memory of 2812 2700 5jjdv.exe 205 PID 2812 wrote to memory of 2764 2812 xxrxflf.exe 35 PID 2812 wrote to memory of 2764 2812 xxrxflf.exe 35 PID 2812 wrote to memory of 2764 2812 xxrxflf.exe 35 PID 2812 wrote to memory of 2764 2812 xxrxflf.exe 35 PID 2764 wrote to memory of 2724 2764 hnhthn.exe 36 PID 2764 wrote to memory of 2724 2764 hnhthn.exe 36 PID 2764 wrote to memory of 2724 2764 hnhthn.exe 36 PID 2764 wrote to memory of 2724 2764 hnhthn.exe 36 PID 2724 wrote to memory of 2628 2724 ddddp.exe 37 PID 2724 wrote to memory of 2628 2724 ddddp.exe 37 PID 2724 wrote to memory of 2628 2724 ddddp.exe 37 PID 2724 wrote to memory of 2628 2724 ddddp.exe 37 PID 2628 wrote to memory of 2652 2628 jvpjj.exe 38 PID 2628 wrote to memory of 2652 2628 jvpjj.exe 38 PID 2628 wrote to memory of 2652 2628 jvpjj.exe 38 PID 2628 wrote to memory of 2652 2628 jvpjj.exe 38 PID 2652 wrote to memory of 1252 2652 fllxlxl.exe 114 PID 2652 wrote to memory of 1252 2652 fllxlxl.exe 114 PID 2652 wrote to memory of 1252 2652 fllxlxl.exe 114 PID 2652 wrote to memory of 1252 2652 fllxlxl.exe 114 PID 1252 wrote to memory of 3008 1252 thhbtt.exe 40 PID 1252 wrote to memory of 3008 1252 thhbtt.exe 40 PID 1252 wrote to memory of 3008 1252 thhbtt.exe 40 PID 1252 wrote to memory of 3008 1252 thhbtt.exe 40 PID 3008 wrote to memory of 764 3008 5jdvv.exe 41 PID 3008 wrote to memory of 764 3008 5jdvv.exe 41 PID 3008 wrote to memory of 764 3008 5jdvv.exe 41 PID 3008 wrote to memory of 764 3008 5jdvv.exe 41 PID 764 wrote to memory of 1688 764 pdddp.exe 42 PID 764 wrote to memory of 1688 764 pdddp.exe 42 PID 764 wrote to memory of 1688 764 pdddp.exe 42 PID 764 wrote to memory of 1688 764 pdddp.exe 42 PID 1688 wrote to memory of 2848 1688 tnbbnb.exe 43 PID 1688 wrote to memory of 2848 1688 tnbbnb.exe 43 PID 1688 wrote to memory of 2848 1688 tnbbnb.exe 43 PID 1688 wrote to memory of 2848 1688 tnbbnb.exe 43 PID 2848 wrote to memory of 1632 2848 9fflrrf.exe 44 PID 2848 wrote to memory of 1632 2848 9fflrrf.exe 44 PID 2848 wrote to memory of 1632 2848 9fflrrf.exe 44 PID 2848 wrote to memory of 1632 2848 9fflrrf.exe 44 PID 1632 wrote to memory of 948 1632 1nhbnt.exe 45 PID 1632 wrote to memory of 948 1632 1nhbnt.exe 45 PID 1632 wrote to memory of 948 1632 1nhbnt.exe 45 PID 1632 wrote to memory of 948 1632 1nhbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rrlrrxl.exec:\rrlrrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\9rflrxl.exec:\9rflrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\5bbhbb.exec:\5bbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\5jjdv.exec:\5jjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xxrxflf.exec:\xxrxflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hnhthn.exec:\hnhthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ddddp.exec:\ddddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jvpjj.exec:\jvpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\fllxlxl.exec:\fllxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\thhbtt.exec:\thhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\5jdvv.exec:\5jdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pdddp.exec:\pdddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\tnbbnb.exec:\tnbbnb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\9fflrrf.exec:\9fflrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1nhbnt.exec:\1nhbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\1ddjv.exec:\1ddjv.exe17⤵
- Executes dropped EXE
PID:948 -
\??\c:\9fxfxfl.exec:\9fxfxfl.exe18⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbbbth.exec:\tbbbth.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\3pjpd.exec:\3pjpd.exe20⤵
- Executes dropped EXE
PID:1820 -
\??\c:\llrffxx.exec:\llrffxx.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nhbhbb.exec:\nhbhbb.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ddvjj.exec:\ddvjj.exe23⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nthtnt.exec:\nthtnt.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pjpvp.exec:\pjpvp.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\xlfxrlx.exec:\xlfxrlx.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnntht.exec:\nnntht.exe28⤵
- Executes dropped EXE
PID:844 -
\??\c:\rxxfrrx.exec:\rxxfrrx.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7nbbbn.exec:\7nbbbn.exe30⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pjjvv.exec:\pjjvv.exe31⤵
- Executes dropped EXE
PID:696 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hbbbhb.exec:\hbbbhb.exe33⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pvvpd.exec:\pvvpd.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\llxrfrl.exec:\llxrfrl.exe35⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nnhbtn.exec:\nnhbtn.exe36⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvvvj.exec:\dvvvj.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rrrlflx.exec:\rrrlflx.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\htbbhh.exec:\htbbhh.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjjpj.exec:\jjjpj.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ppvpd.exec:\ppvpd.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnbtnb.exec:\tnbtnb.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9hhtht.exec:\9hhtht.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5jjjd.exec:\5jjjd.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3hhnnt.exec:\3hhnnt.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hhnbbn.exec:\hhnbbn.exe47⤵
- Executes dropped EXE
PID:668 -
\??\c:\7jjdp.exec:\7jjdp.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1fxlxfl.exec:\1fxlxfl.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvpvj.exec:\dvpvj.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1vvpp.exec:\1vvpp.exe51⤵
- Executes dropped EXE
PID:264 -
\??\c:\lllxxrl.exec:\lllxxrl.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bhnhnn.exec:\bhnhnn.exe53⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hhthbn.exec:\hhthbn.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5ddpd.exec:\5ddpd.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rffrlfl.exec:\rffrlfl.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnbnhn.exec:\tnbnhn.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1vvpj.exec:\1vvpj.exe59⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9pjvv.exec:\9pjvv.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\lxfffxx.exec:\lxfffxx.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\tnntbh.exec:\tnntbh.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bbbtnb.exec:\bbbtnb.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jvjjj.exec:\jvjjj.exe64⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rxxrfxf.exec:\rxxrfxf.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbbhbn.exec:\bbbhbn.exe66⤵PID:2460
-
\??\c:\thnnbt.exec:\thnnbt.exe67⤵PID:2964
-
\??\c:\pppjd.exec:\pppjd.exe68⤵PID:1816
-
\??\c:\flfrlff.exec:\flfrlff.exe69⤵PID:2972
-
\??\c:\nntbtn.exec:\nntbtn.exe70⤵PID:1084
-
\??\c:\bbhnbh.exec:\bbhnbh.exe71⤵PID:2416
-
\??\c:\jddpj.exec:\jddpj.exe72⤵PID:1156
-
\??\c:\xffxrxx.exec:\xffxrxx.exe73⤵PID:1860
-
\??\c:\xlxllff.exec:\xlxllff.exe74⤵PID:2552
-
\??\c:\htnhth.exec:\htnhth.exe75⤵PID:2320
-
\??\c:\nnhnnh.exec:\nnhnnh.exe76⤵PID:1796
-
\??\c:\jppjj.exec:\jppjj.exe77⤵PID:2492
-
\??\c:\lxflxrx.exec:\lxflxrx.exe78⤵PID:2816
-
\??\c:\hnbbbb.exec:\hnbbbb.exe79⤵PID:2864
-
\??\c:\nhhthn.exec:\nhhthn.exe80⤵PID:2304
-
\??\c:\vvjvv.exec:\vvjvv.exe81⤵PID:2924
-
\??\c:\3rlxfrx.exec:\3rlxfrx.exe82⤵PID:2080
-
\??\c:\rrlflff.exec:\rrlflff.exe83⤵PID:2872
-
\??\c:\hhnhht.exec:\hhnhht.exe84⤵PID:2980
-
\??\c:\ddpdd.exec:\ddpdd.exe85⤵PID:2660
-
\??\c:\7jdpd.exec:\7jdpd.exe86⤵PID:1252
-
\??\c:\xxxlxll.exec:\xxxlxll.exe87⤵PID:2036
-
\??\c:\9rlrflr.exec:\9rlrflr.exe88⤵PID:3004
-
\??\c:\tbhhhh.exec:\tbhhhh.exe89⤵PID:1800
-
\??\c:\pdvjj.exec:\pdvjj.exe90⤵PID:1804
-
\??\c:\dpvpd.exec:\dpvpd.exe91⤵PID:2772
-
\??\c:\7lfrrlx.exec:\7lfrrlx.exe92⤵PID:1128
-
\??\c:\bttbnb.exec:\bttbnb.exe93⤵PID:264
-
\??\c:\jjjpj.exec:\jjjpj.exe94⤵PID:624
-
\??\c:\9ppvj.exec:\9ppvj.exe95⤵PID:580
-
\??\c:\llflrrf.exec:\llflrrf.exe96⤵PID:1580
-
\??\c:\3nnhnn.exec:\3nnhnn.exe97⤵PID:2216
-
\??\c:\1hthht.exec:\1hthht.exe98⤵PID:2248
-
\??\c:\jppdp.exec:\jppdp.exe99⤵PID:2280
-
\??\c:\5xfrxrl.exec:\5xfrxrl.exe100⤵PID:2428
-
\??\c:\nttthb.exec:\nttthb.exe101⤵PID:2440
-
\??\c:\tnnttb.exec:\tnnttb.exe102⤵PID:304
-
\??\c:\jpvvp.exec:\jpvvp.exe103⤵PID:1152
-
\??\c:\lrlllxf.exec:\lrlllxf.exe104⤵PID:2040
-
\??\c:\9btnhn.exec:\9btnhn.exe105⤵PID:2940
-
\??\c:\5thtnt.exec:\5thtnt.exe106⤵PID:2236
-
\??\c:\dppvv.exec:\dppvv.exe107⤵PID:1672
-
\??\c:\lrrfxfr.exec:\lrrfxfr.exe108⤵PID:1808
-
\??\c:\flxxfxx.exec:\flxxfxx.exe109⤵PID:1456
-
\??\c:\hhhhth.exec:\hhhhth.exe110⤵PID:2336
-
\??\c:\httnnn.exec:\httnnn.exe111⤵PID:1824
-
\??\c:\ppvjd.exec:\ppvjd.exe112⤵PID:3028
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe113⤵PID:3024
-
\??\c:\lrrxlrl.exec:\lrrxlrl.exe114⤵PID:2416
-
\??\c:\thbbbt.exec:\thbbbt.exe115⤵PID:1156
-
\??\c:\jvppp.exec:\jvppp.exe116⤵PID:1860
-
\??\c:\pjvvv.exec:\pjvvv.exe117⤵PID:1556
-
\??\c:\xxrfrfx.exec:\xxrfrfx.exe118⤵PID:2320
-
\??\c:\thtthb.exec:\thtthb.exe119⤵PID:2192
-
\??\c:\btntnt.exec:\btntnt.exe120⤵PID:2536
-
\??\c:\9djvv.exec:\9djvv.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-