Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 23:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe
-
Size
457KB
-
MD5
02f45a3d77ea7020705f910c5135be9b
-
SHA1
0c1bf1c647830cd631897db58e3df42ec4772d99
-
SHA256
4862c022813c7af4ed293d6108c0acc46cdb74b531faab36ea27bb33e175e22f
-
SHA512
c7a7c0f052aab2df36590989f3e5f2e6f28df7ce7890b753a7dc9859cdcb1f59110b37214bb763ba4111a1f1e64ecbd0aab6691738948890499764dfd9553c30
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1Hssto:d7Tc9Wj16A3Stvxg
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1608-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-725-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-848-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-686-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-582-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-563-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-509-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-488-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1608 5bbbbb.exe 100 vjpdv.exe 4904 flxrrrr.exe 3816 nnhbtt.exe 4088 xrxfflr.exe 2888 rllfxfr.exe 4484 pvvvp.exe 2452 5rfrrrl.exe 4952 pdvpd.exe 892 7bnnbh.exe 1416 vpdjv.exe 1692 tthtnn.exe 3084 vdvpd.exe 3172 lllllrr.exe 3704 dvjjd.exe 3412 fxxrrll.exe 452 dvjvv.exe 2696 xrlxlxl.exe 3060 htbbbb.exe 4780 rfxxxfl.exe 4052 hbhhnn.exe 4260 ddjpd.exe 3476 rfllrrr.exe 2412 3pvpp.exe 2900 ppvpp.exe 2324 flrxxff.exe 4472 bbnhtt.exe 2208 xxffxfx.exe 1784 bhbbnt.exe 2544 dvjdv.exe 3264 nhbhtn.exe 1136 vdppp.exe 1272 jpppv.exe 764 bttnnn.exe 384 jpdvj.exe 788 jvdpd.exe 3504 lfrlllx.exe 4156 hhhtbb.exe 4516 7hbbbb.exe 4992 jdjpd.exe 1608 jdjjd.exe 4596 1lxxrxx.exe 1100 lxflflr.exe 2976 1bhbtt.exe 4972 xxxrllf.exe 3324 nhbbnh.exe 1400 htnhbn.exe 4364 5pppp.exe 3924 fxlrrxf.exe 2584 hhnbbb.exe 4952 pppjv.exe 3524 5llllrr.exe 3376 bbbntb.exe 2548 hthnbt.exe 1084 dvdvv.exe 3084 tbhtth.exe 5052 ddpvp.exe 3704 xxfrrlx.exe 184 tnbhbb.exe 2420 pdjjv.exe 2692 fllfrll.exe 3896 9ntnnb.exe 3596 3ppjd.exe 1780 1ffxxrr.exe -
resource yara_rule behavioral2/memory/1608-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/184-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-516-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-526-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-649-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-656-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-675-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-691-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-725-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-826-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-852-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-868-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-848-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-797-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-787-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-777-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-736-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-687-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-686-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-682-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-608-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-589-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-582-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-563-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-549-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-509-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-505-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-488-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-475-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 1608 4992 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 84 PID 4992 wrote to memory of 1608 4992 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 84 PID 4992 wrote to memory of 1608 4992 02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe 84 PID 1608 wrote to memory of 100 1608 5bbbbb.exe 85 PID 1608 wrote to memory of 100 1608 5bbbbb.exe 85 PID 1608 wrote to memory of 100 1608 5bbbbb.exe 85 PID 100 wrote to memory of 4904 100 vjpdv.exe 86 PID 100 wrote to memory of 4904 100 vjpdv.exe 86 PID 100 wrote to memory of 4904 100 vjpdv.exe 86 PID 4904 wrote to memory of 3816 4904 flxrrrr.exe 88 PID 4904 wrote to memory of 3816 4904 flxrrrr.exe 88 PID 4904 wrote to memory of 3816 4904 flxrrrr.exe 88 PID 3816 wrote to memory of 4088 3816 nnhbtt.exe 89 PID 3816 wrote to memory of 4088 3816 nnhbtt.exe 89 PID 3816 wrote to memory of 4088 3816 nnhbtt.exe 89 PID 4088 wrote to memory of 2888 4088 xrxfflr.exe 90 PID 4088 wrote to memory of 2888 4088 xrxfflr.exe 90 PID 4088 wrote to memory of 2888 4088 xrxfflr.exe 90 PID 2888 wrote to memory of 4484 2888 rllfxfr.exe 92 PID 2888 wrote to memory of 4484 2888 rllfxfr.exe 92 PID 2888 wrote to memory of 4484 2888 rllfxfr.exe 92 PID 4484 wrote to memory of 2452 4484 pvvvp.exe 93 PID 4484 wrote to memory of 2452 4484 pvvvp.exe 93 PID 4484 wrote to memory of 2452 4484 pvvvp.exe 93 PID 2452 wrote to memory of 4952 2452 5rfrrrl.exe 95 PID 2452 wrote to memory of 4952 2452 5rfrrrl.exe 95 PID 2452 wrote to memory of 4952 2452 5rfrrrl.exe 95 PID 4952 wrote to memory of 892 4952 pdvpd.exe 96 PID 4952 wrote to memory of 892 4952 pdvpd.exe 96 PID 4952 wrote to memory of 892 4952 pdvpd.exe 96 PID 892 wrote to memory of 1416 892 7bnnbh.exe 97 PID 892 wrote to memory of 1416 892 7bnnbh.exe 97 PID 892 wrote to memory of 1416 892 7bnnbh.exe 97 PID 1416 wrote to memory of 1692 1416 vpdjv.exe 98 PID 1416 wrote to memory of 1692 1416 vpdjv.exe 98 PID 1416 wrote to memory of 1692 1416 vpdjv.exe 98 PID 1692 wrote to memory of 3084 1692 tthtnn.exe 99 PID 1692 wrote to memory of 3084 1692 tthtnn.exe 99 PID 1692 wrote to memory of 3084 1692 tthtnn.exe 99 PID 3084 wrote to memory of 3172 3084 vdvpd.exe 100 PID 3084 wrote to memory of 3172 3084 vdvpd.exe 100 PID 3084 wrote to memory of 3172 3084 vdvpd.exe 100 PID 3172 wrote to memory of 3704 3172 lllllrr.exe 101 PID 3172 wrote to memory of 3704 3172 lllllrr.exe 101 PID 3172 wrote to memory of 3704 3172 lllllrr.exe 101 PID 3704 wrote to memory of 3412 3704 dvjjd.exe 102 PID 3704 wrote to memory of 3412 3704 dvjjd.exe 102 PID 3704 wrote to memory of 3412 3704 dvjjd.exe 102 PID 3412 wrote to memory of 452 3412 fxxrrll.exe 103 PID 3412 wrote to memory of 452 3412 fxxrrll.exe 103 PID 3412 wrote to memory of 452 3412 fxxrrll.exe 103 PID 452 wrote to memory of 2696 452 dvjvv.exe 104 PID 452 wrote to memory of 2696 452 dvjvv.exe 104 PID 452 wrote to memory of 2696 452 dvjvv.exe 104 PID 2696 wrote to memory of 3060 2696 xrlxlxl.exe 244 PID 2696 wrote to memory of 3060 2696 xrlxlxl.exe 244 PID 2696 wrote to memory of 3060 2696 xrlxlxl.exe 244 PID 3060 wrote to memory of 4780 3060 htbbbb.exe 106 PID 3060 wrote to memory of 4780 3060 htbbbb.exe 106 PID 3060 wrote to memory of 4780 3060 htbbbb.exe 106 PID 4780 wrote to memory of 4052 4780 rfxxxfl.exe 107 PID 4780 wrote to memory of 4052 4780 rfxxxfl.exe 107 PID 4780 wrote to memory of 4052 4780 rfxxxfl.exe 107 PID 4052 wrote to memory of 4260 4052 hbhhnn.exe 108
Processes
-
C:\Windows\System32\sobql9.exe"C:\Windows\System32\sobql9.exe"1⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02f45a3d77ea7020705f910c5135be9b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\5bbbbb.exec:\5bbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vjpdv.exec:\vjpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\flxrrrr.exec:\flxrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\nnhbtt.exec:\nnhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\xrxfflr.exec:\xrxfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\rllfxfr.exec:\rllfxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pvvvp.exec:\pvvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\5rfrrrl.exec:\5rfrrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\pdvpd.exec:\pdvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\7bnnbh.exec:\7bnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\vpdjv.exec:\vpdjv.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\tthtnn.exec:\tthtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\vdvpd.exec:\vdvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\lllllrr.exec:\lllllrr.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\dvjjd.exec:\dvjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\fxxrrll.exec:\fxxrrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\dvjvv.exec:\dvjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\xrlxlxl.exec:\xrlxlxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\htbbbb.exec:\htbbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\hbhhnn.exec:\hbhhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\ddjpd.exec:\ddjpd.exe23⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rfllrrr.exec:\rfllrrr.exe24⤵
- Executes dropped EXE
PID:3476 -
\??\c:\3pvpp.exec:\3pvpp.exe25⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ppvpp.exec:\ppvpp.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\flrxxff.exec:\flrxxff.exe27⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbnhtt.exec:\bbnhtt.exe28⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xxffxfx.exec:\xxffxfx.exe29⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bhbbnt.exec:\bhbbnt.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvjdv.exec:\dvjdv.exe31⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhbhtn.exec:\nhbhtn.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vdppp.exec:\vdppp.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1136 -
\??\c:\jpppv.exec:\jpppv.exe34⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bttnnn.exec:\bttnnn.exe35⤵
- Executes dropped EXE
PID:764 -
\??\c:\jpdvj.exec:\jpdvj.exe36⤵
- Executes dropped EXE
PID:384 -
\??\c:\jvdpd.exec:\jvdpd.exe37⤵
- Executes dropped EXE
PID:788 -
\??\c:\lfrlllx.exec:\lfrlllx.exe38⤵
- Executes dropped EXE
PID:3504 -
\??\c:\hhhtbb.exec:\hhhtbb.exe39⤵
- Executes dropped EXE
PID:4156 -
\??\c:\7rrlrll.exec:\7rrlrll.exe40⤵PID:1540
-
\??\c:\7hbbbb.exec:\7hbbbb.exe41⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdjpd.exec:\jdjpd.exe42⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jdjjd.exec:\jdjjd.exe43⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1lxxrxx.exec:\1lxxrxx.exe44⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lxflflr.exec:\lxflflr.exe45⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1bhbtt.exec:\1bhbtt.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xxxrllf.exec:\xxxrllf.exe47⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nhbbnh.exec:\nhbbnh.exe48⤵
- Executes dropped EXE
PID:3324 -
\??\c:\htnhbn.exec:\htnhbn.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5pppp.exec:\5pppp.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe51⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhnbbb.exec:\hhnbbb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\pppjv.exec:\pppjv.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952 -
\??\c:\5llllrr.exec:\5llllrr.exe54⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bbbntb.exec:\bbbntb.exe55⤵
- Executes dropped EXE
PID:3376 -
\??\c:\hthnbt.exec:\hthnbt.exe56⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvdvv.exec:\dvdvv.exe57⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tbhtth.exec:\tbhtth.exe58⤵
- Executes dropped EXE
PID:3084 -
\??\c:\ddpvp.exec:\ddpvp.exe59⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xxfrrlx.exec:\xxfrrlx.exe60⤵
- Executes dropped EXE
PID:3704 -
\??\c:\tnbhbb.exec:\tnbhbb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:184 -
\??\c:\pdjjv.exec:\pdjjv.exe62⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllfrll.exec:\fllfrll.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9ntnnb.exec:\9ntnnb.exe64⤵
- Executes dropped EXE
PID:3896 -
\??\c:\3ppjd.exec:\3ppjd.exe65⤵
- Executes dropped EXE
PID:3596 -
\??\c:\1ffxxrr.exec:\1ffxxrr.exe66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\1rrlllf.exec:\1rrlllf.exe67⤵PID:4532
-
\??\c:\hbhbbb.exec:\hbhbbb.exe68⤵PID:4160
-
\??\c:\jvvvv.exec:\jvvvv.exe69⤵PID:1044
-
\??\c:\vvvvv.exec:\vvvvv.exe70⤵PID:4416
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe71⤵PID:2552
-
\??\c:\hnnhhh.exec:\hnnhhh.exe72⤵PID:2156
-
\??\c:\hnbbbb.exec:\hnbbbb.exe73⤵PID:4040
-
\??\c:\vpvpp.exec:\vpvpp.exe74⤵PID:4816
-
\??\c:\lllffff.exec:\lllffff.exe75⤵PID:4832
-
\??\c:\hnnnbh.exec:\hnnnbh.exe76⤵
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\7hbbbh.exec:\7hbbbh.exe77⤵PID:4492
-
\??\c:\vdjjj.exec:\vdjjj.exe78⤵PID:4848
-
\??\c:\fffxxxr.exec:\fffxxxr.exe79⤵PID:1932
-
\??\c:\9xfffll.exec:\9xfffll.exe80⤵PID:2120
-
\??\c:\hnhhnn.exec:\hnhhnn.exe81⤵PID:3148
-
\??\c:\ddpjp.exec:\ddpjp.exe82⤵PID:3480
-
\??\c:\vpdjj.exec:\vpdjj.exe83⤵PID:3572
-
\??\c:\ffffllr.exec:\ffffllr.exe84⤵PID:3688
-
\??\c:\tbtttt.exec:\tbtttt.exe85⤵PID:4312
-
\??\c:\dpdjj.exec:\dpdjj.exe86⤵PID:4404
-
\??\c:\1vdvv.exec:\1vdvv.exe87⤵PID:1464
-
\??\c:\5xllfff.exec:\5xllfff.exe88⤵PID:1936
-
\??\c:\5bnhnt.exec:\5bnhnt.exe89⤵
- System Location Discovery: System Language Discovery
PID:3248 -
\??\c:\dpddp.exec:\dpddp.exe90⤵PID:2032
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe91⤵PID:1088
-
\??\c:\lrrflfl.exec:\lrrflfl.exe92⤵PID:4856
-
\??\c:\pvvvp.exec:\pvvvp.exe93⤵PID:4524
-
\??\c:\dvvvp.exec:\dvvvp.exe94⤵PID:4560
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe95⤵PID:2472
-
\??\c:\btbtnt.exec:\btbtnt.exe96⤵PID:2920
-
\??\c:\jdjdj.exec:\jdjdj.exe97⤵PID:636
-
\??\c:\dpvjv.exec:\dpvjv.exe98⤵PID:3696
-
\??\c:\nbtnht.exec:\nbtnht.exe99⤵PID:2776
-
\??\c:\hthhnt.exec:\hthhnt.exe100⤵PID:2304
-
\??\c:\jddvv.exec:\jddvv.exe101⤵PID:1560
-
\??\c:\xfffxfx.exec:\xfffxfx.exe102⤵PID:3524
-
\??\c:\tntnnb.exec:\tntnnb.exe103⤵PID:3376
-
\??\c:\vvjdd.exec:\vvjdd.exe104⤵PID:2548
-
\??\c:\fxxxxff.exec:\fxxxxff.exe105⤵PID:3872
-
\??\c:\nbbbnn.exec:\nbbbnn.exe106⤵PID:4188
-
\??\c:\pvpvp.exec:\pvpvp.exe107⤵PID:4500
-
\??\c:\ffffxff.exec:\ffffxff.exe108⤵PID:4864
-
\??\c:\thhbnh.exec:\thhbnh.exe109⤵PID:2224
-
\??\c:\pddjd.exec:\pddjd.exe110⤵PID:2000
-
\??\c:\pvpjv.exec:\pvpjv.exe111⤵PID:452
-
\??\c:\hhnnbn.exec:\hhnnbn.exe112⤵PID:2540
-
\??\c:\9nttbh.exec:\9nttbh.exe113⤵PID:2868
-
\??\c:\jjvpv.exec:\jjvpv.exe114⤵PID:4780
-
\??\c:\xflllrx.exec:\xflllrx.exe115⤵PID:784
-
\??\c:\nbhtnh.exec:\nbhtnh.exe116⤵PID:2732
-
\??\c:\pjpjj.exec:\pjpjj.exe117⤵PID:4160
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe118⤵PID:760
-
\??\c:\nntnhh.exec:\nntnhh.exe119⤵PID:2356
-
\??\c:\vpvpv.exec:\vpvpv.exe120⤵PID:2900
-
\??\c:\vjpvp.exec:\vjpvp.exe121⤵PID:5012
-
\??\c:\fffxxfx.exec:\fffxxfx.exe122⤵PID:5032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-