Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe
-
Size
452KB
-
MD5
000ea8ce46678a3b387e61ac26b6c082
-
SHA1
29c560567fcb80f352edb91c436d7aaa919d7e0a
-
SHA256
d4d3e12f008b7d974edcdef2680656acaabcbbb758a8594d2ef739c91c1cd78e
-
SHA512
199f946909f752afc0a64a36754fe8b29c3c1e049491e6eaa5b22c44668486637d262b7fb988d26d68962cd5b4bebcaca67c7ca8b6d39647d097dd28b55d3b54
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HsMKe:d7Tc9Wj16A3Stvxvz
Malware Config
Signatures
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral2/memory/4900-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-472-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-509-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-584-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-588-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-611-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-640-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-644-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-678-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3496 nntntt.exe 4196 ntbtbh.exe 2984 rxffxlr.exe 728 hhhtth.exe 3548 xxrrrrr.exe 3248 bnnnnt.exe 1212 vvjvj.exe 2980 hbtbtb.exe 2000 pdvvd.exe 2188 pjddv.exe 2308 lxlxxxx.exe 5084 thhnhn.exe 4180 xlrllrr.exe 3920 hnbnbn.exe 3980 1rfrxlr.exe 628 7lrrlrr.exe 2920 rrllrxf.exe 2272 vppjp.exe 4028 rxllrrx.exe 3756 djpdj.exe 3668 nntntn.exe 1856 vjdvv.exe 2728 lfxrxlx.exe 2220 hhnbnn.exe 1796 lfflfxl.exe 3452 nbhbbb.exe 3212 vvpdv.exe 4772 fxffllr.exe 4788 vvpdd.exe 5004 pjdvd.exe 2004 lffrllx.exe 736 jvdpj.exe 3000 bnhtnb.exe 1264 jjjjd.exe 1936 1rxxrxl.exe 1848 thhttn.exe 2096 jdpjp.exe 3572 lflffll.exe 3260 tnnhhh.exe 4616 dpvpp.exe 2016 xfxlffx.exe 2344 ttthbt.exe 1464 jjdpj.exe 1904 llllfxr.exe 2000 ddjdp.exe 4780 dpjpj.exe 1352 lfxrxrl.exe 3388 nbbhhh.exe 2988 pddvp.exe 5000 vpdvj.exe 844 rxfxrrr.exe 2324 nhtntn.exe 3920 jjvpp.exe 3980 dvjjd.exe 3028 rrrxxxx.exe 540 hhttbb.exe 3108 9vdvv.exe 4044 rlllxrx.exe 208 ffrlfff.exe 4432 ntbtnn.exe 1512 vvvjd.exe 4648 7lrllll.exe 3608 bbbnnn.exe 4820 ddvpj.exe -
resource yara_rule behavioral2/memory/3496-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-495-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3496 4900 000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe 84 PID 4900 wrote to memory of 3496 4900 000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe 84 PID 4900 wrote to memory of 3496 4900 000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe 84 PID 3496 wrote to memory of 4196 3496 nntntt.exe 85 PID 3496 wrote to memory of 4196 3496 nntntt.exe 85 PID 3496 wrote to memory of 4196 3496 nntntt.exe 85 PID 4196 wrote to memory of 2984 4196 ntbtbh.exe 86 PID 4196 wrote to memory of 2984 4196 ntbtbh.exe 86 PID 4196 wrote to memory of 2984 4196 ntbtbh.exe 86 PID 2984 wrote to memory of 728 2984 rxffxlr.exe 87 PID 2984 wrote to memory of 728 2984 rxffxlr.exe 87 PID 2984 wrote to memory of 728 2984 rxffxlr.exe 87 PID 728 wrote to memory of 3548 728 hhhtth.exe 88 PID 728 wrote to memory of 3548 728 hhhtth.exe 88 PID 728 wrote to memory of 3548 728 hhhtth.exe 88 PID 3548 wrote to memory of 3248 3548 xxrrrrr.exe 89 PID 3548 wrote to memory of 3248 3548 xxrrrrr.exe 89 PID 3548 wrote to memory of 3248 3548 xxrrrrr.exe 89 PID 3248 wrote to memory of 1212 3248 bnnnnt.exe 90 PID 3248 wrote to memory of 1212 3248 bnnnnt.exe 90 PID 3248 wrote to memory of 1212 3248 bnnnnt.exe 90 PID 1212 wrote to memory of 2980 1212 vvjvj.exe 91 PID 1212 wrote to memory of 2980 1212 vvjvj.exe 91 PID 1212 wrote to memory of 2980 1212 vvjvj.exe 91 PID 2980 wrote to memory of 2000 2980 hbtbtb.exe 92 PID 2980 wrote to memory of 2000 2980 hbtbtb.exe 92 PID 2980 wrote to memory of 2000 2980 hbtbtb.exe 92 PID 2000 wrote to memory of 2188 2000 pdvvd.exe 93 PID 2000 wrote to memory of 2188 2000 pdvvd.exe 93 PID 2000 wrote to memory of 2188 2000 pdvvd.exe 93 PID 2188 wrote to memory of 2308 2188 pjddv.exe 95 PID 2188 wrote to memory of 2308 2188 pjddv.exe 95 PID 2188 wrote to memory of 2308 2188 pjddv.exe 95 PID 2308 wrote to memory of 5084 2308 lxlxxxx.exe 96 PID 2308 wrote to memory of 5084 2308 lxlxxxx.exe 96 PID 2308 wrote to memory of 5084 2308 lxlxxxx.exe 96 PID 5084 wrote to memory of 4180 5084 thhnhn.exe 98 PID 5084 wrote to memory of 4180 5084 thhnhn.exe 98 PID 5084 wrote to memory of 4180 5084 thhnhn.exe 98 PID 4180 wrote to memory of 3920 4180 xlrllrr.exe 100 PID 4180 wrote to memory of 3920 4180 xlrllrr.exe 100 PID 4180 wrote to memory of 3920 4180 xlrllrr.exe 100 PID 3920 wrote to memory of 3980 3920 hnbnbn.exe 101 PID 3920 wrote to memory of 3980 3920 hnbnbn.exe 101 PID 3920 wrote to memory of 3980 3920 hnbnbn.exe 101 PID 3980 wrote to memory of 628 3980 1rfrxlr.exe 102 PID 3980 wrote to memory of 628 3980 1rfrxlr.exe 102 PID 3980 wrote to memory of 628 3980 1rfrxlr.exe 102 PID 628 wrote to memory of 2920 628 7lrrlrr.exe 103 PID 628 wrote to memory of 2920 628 7lrrlrr.exe 103 PID 628 wrote to memory of 2920 628 7lrrlrr.exe 103 PID 2920 wrote to memory of 2272 2920 rrllrxf.exe 104 PID 2920 wrote to memory of 2272 2920 rrllrxf.exe 104 PID 2920 wrote to memory of 2272 2920 rrllrxf.exe 104 PID 2272 wrote to memory of 4028 2272 vppjp.exe 105 PID 2272 wrote to memory of 4028 2272 vppjp.exe 105 PID 2272 wrote to memory of 4028 2272 vppjp.exe 105 PID 4028 wrote to memory of 3756 4028 rxllrrx.exe 106 PID 4028 wrote to memory of 3756 4028 rxllrrx.exe 106 PID 4028 wrote to memory of 3756 4028 rxllrrx.exe 106 PID 3756 wrote to memory of 3668 3756 djpdj.exe 107 PID 3756 wrote to memory of 3668 3756 djpdj.exe 107 PID 3756 wrote to memory of 3668 3756 djpdj.exe 107 PID 3668 wrote to memory of 1856 3668 nntntn.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\000ea8ce46678a3b387e61ac26b6c082_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nntntt.exec:\nntntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\ntbtbh.exec:\ntbtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\rxffxlr.exec:\rxffxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hhhtth.exec:\hhhtth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\bnnnnt.exec:\bnnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\vvjvj.exec:\vvjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\hbtbtb.exec:\hbtbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pdvvd.exec:\pdvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pjddv.exec:\pjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\lxlxxxx.exec:\lxlxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\thhnhn.exec:\thhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\xlrllrr.exec:\xlrllrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\hnbnbn.exec:\hnbnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\1rfrxlr.exec:\1rfrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\7lrrlrr.exec:\7lrrlrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rrllrxf.exec:\rrllrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vppjp.exec:\vppjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rxllrrx.exec:\rxllrrx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\djpdj.exec:\djpdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\nntntn.exec:\nntntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\vjdvv.exec:\vjdvv.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe24⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhnbnn.exec:\hhnbnn.exe25⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lfflfxl.exec:\lfflfxl.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nbhbbb.exec:\nbhbbb.exe27⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vvpdv.exec:\vvpdv.exe28⤵
- Executes dropped EXE
PID:3212 -
\??\c:\fxffllr.exec:\fxffllr.exe29⤵
- Executes dropped EXE
PID:4772 -
\??\c:\vvpdd.exec:\vvpdd.exe30⤵
- Executes dropped EXE
PID:4788 -
\??\c:\pjdvd.exec:\pjdvd.exe31⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lffrllx.exec:\lffrllx.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jvdpj.exec:\jvdpj.exe33⤵
- Executes dropped EXE
PID:736 -
\??\c:\jvdvp.exec:\jvdvp.exe34⤵PID:1960
-
\??\c:\bnhtnb.exec:\bnhtnb.exe35⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jjjjd.exec:\jjjjd.exe36⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1rxxrxl.exec:\1rxxrxl.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\thhttn.exec:\thhttn.exe38⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdpjp.exec:\jdpjp.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lflffll.exec:\lflffll.exe40⤵
- Executes dropped EXE
PID:3572 -
\??\c:\tnnhhh.exec:\tnnhhh.exe41⤵
- Executes dropped EXE
PID:3260 -
\??\c:\dpvpp.exec:\dpvpp.exe42⤵
- Executes dropped EXE
PID:4616 -
\??\c:\xfxlffx.exec:\xfxlffx.exe43⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ttthbt.exec:\ttthbt.exe44⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jjdpj.exec:\jjdpj.exe45⤵
- Executes dropped EXE
PID:1464 -
\??\c:\llllfxr.exec:\llllfxr.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddjdp.exec:\ddjdp.exe47⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dpjpj.exec:\dpjpj.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nbbhhh.exec:\nbbhhh.exe50⤵
- Executes dropped EXE
PID:3388 -
\??\c:\pddvp.exec:\pddvp.exe51⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpdvj.exec:\vpdvj.exe52⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe53⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhtntn.exec:\nhtntn.exe54⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jjvpp.exec:\jjvpp.exe55⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dvjjd.exec:\dvjjd.exe56⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rrrxxxx.exec:\rrrxxxx.exe57⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhttbb.exec:\hhttbb.exe58⤵
- Executes dropped EXE
PID:540 -
\??\c:\9vdvv.exec:\9vdvv.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\rlllxrx.exec:\rlllxrx.exe60⤵
- Executes dropped EXE
PID:4044 -
\??\c:\ffrlfff.exec:\ffrlfff.exe61⤵
- Executes dropped EXE
PID:208 -
\??\c:\ntbtnn.exec:\ntbtnn.exe62⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvvjd.exec:\vvvjd.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7lrllll.exec:\7lrllll.exe64⤵
- Executes dropped EXE
PID:4648 -
\??\c:\bbbnnn.exec:\bbbnnn.exe65⤵
- Executes dropped EXE
PID:3608 -
\??\c:\ddvpj.exec:\ddvpj.exe66⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rxxxfrf.exec:\rxxxfrf.exe67⤵PID:4060
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe68⤵PID:4148
-
\??\c:\tbtnbn.exec:\tbtnbn.exe69⤵PID:4776
-
\??\c:\vvpdv.exec:\vvpdv.exe70⤵PID:4416
-
\??\c:\rxflrlx.exec:\rxflrlx.exe71⤵PID:3344
-
\??\c:\5hhbbb.exec:\5hhbbb.exe72⤵PID:3456
-
\??\c:\7ddvv.exec:\7ddvv.exe73⤵PID:4788
-
\??\c:\flfllfr.exec:\flfllfr.exe74⤵PID:2304
-
\??\c:\nbthbt.exec:\nbthbt.exe75⤵PID:4216
-
\??\c:\dvjvj.exec:\dvjvj.exe76⤵PID:4468
-
\??\c:\xxxrllx.exec:\xxxrllx.exe77⤵PID:1576
-
\??\c:\bnbhnn.exec:\bnbhnn.exe78⤵PID:4372
-
\??\c:\dpvdj.exec:\dpvdj.exe79⤵PID:3948
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe80⤵PID:4196
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe81⤵PID:2816
-
\??\c:\tthbbb.exec:\tthbbb.exe82⤵PID:1848
-
\??\c:\pjjvv.exec:\pjjvv.exe83⤵PID:4784
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe84⤵PID:1360
-
\??\c:\5tthbt.exec:\5tthbt.exe85⤵PID:2212
-
\??\c:\bttnhh.exec:\bttnhh.exe86⤵PID:1564
-
\??\c:\9pjdv.exec:\9pjdv.exe87⤵PID:464
-
\??\c:\xrrrllf.exec:\xrrrllf.exe88⤵PID:3664
-
\??\c:\nbbbtt.exec:\nbbbtt.exe89⤵PID:1580
-
\??\c:\dvvvj.exec:\dvvvj.exe90⤵PID:1396
-
\??\c:\xfxrrxx.exec:\xfxrrxx.exe91⤵PID:2308
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe92⤵PID:3104
-
\??\c:\ddppp.exec:\ddppp.exe93⤵PID:3388
-
\??\c:\3dvdp.exec:\3dvdp.exe94⤵PID:5080
-
\??\c:\lrxffff.exec:\lrxffff.exe95⤵PID:5000
-
\??\c:\htbhbh.exec:\htbhbh.exe96⤵PID:3540
-
\??\c:\jvdvp.exec:\jvdvp.exe97⤵PID:624
-
\??\c:\djjvj.exec:\djjvj.exe98⤵PID:1008
-
\??\c:\rffxrrl.exec:\rffxrrl.exe99⤵PID:2868
-
\??\c:\nhthnn.exec:\nhthnn.exe100⤵PID:2920
-
\??\c:\ppvpj.exec:\ppvpj.exe101⤵PID:2332
-
\??\c:\9dpdv.exec:\9dpdv.exe102⤵PID:3908
-
\??\c:\lxxffff.exec:\lxxffff.exe103⤵PID:4028
-
\??\c:\nbbtnn.exec:\nbbtnn.exe104⤵PID:396
-
\??\c:\pjjjd.exec:\pjjjd.exe105⤵PID:3488
-
\??\c:\dvpjj.exec:\dvpjj.exe106⤵PID:1676
-
\??\c:\rxfxlxr.exec:\rxfxlxr.exe107⤵PID:1900
-
\??\c:\bbnnhh.exec:\bbnnhh.exe108⤵PID:4648
-
\??\c:\jdvpd.exec:\jdvpd.exe109⤵PID:5112
-
\??\c:\rllxrff.exec:\rllxrff.exe110⤵
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\ntnbtt.exec:\ntnbtt.exe111⤵PID:3700
-
\??\c:\tnnhbt.exec:\tnnhbt.exe112⤵PID:2088
-
\??\c:\xxlfrff.exec:\xxlfrff.exe113⤵PID:4284
-
\??\c:\frflrxx.exec:\frflrxx.exe114⤵PID:3984
-
\??\c:\7bbbnh.exec:\7bbbnh.exe115⤵PID:1948
-
\??\c:\pvddj.exec:\pvddj.exe116⤵PID:1556
-
\??\c:\pdppj.exec:\pdppj.exe117⤵PID:4344
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe118⤵PID:4328
-
\??\c:\nnntth.exec:\nnntth.exe119⤵PID:3564
-
\??\c:\3vjdv.exec:\3vjdv.exe120⤵PID:4508
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe121⤵PID:4800
-
\??\c:\tnbttt.exec:\tnbttt.exe122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-