Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 20:32
Behavioral task
behavioral1
Sample
00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe
-
Size
98KB
-
MD5
00744cfd58a0aa6588267fd05c53d4ba
-
SHA1
419914f07d6163b8d815ac7deeee4ef954490fda
-
SHA256
6382bfeedc9194d374928545855e9917933b9e1d0a158574cf0d416d7cf63a56
-
SHA512
be08cfd76248b1377a6cb1c6bf003a74a2cf3043f6f979bbccb781cf389a73cf62e0b88df62de84b05760bced908275f12bc2ffe9ab9bf0ae6d9ae16a27f3b59
-
SSDEEP
3072:JhOmTsF93UYfwC6GIoutWFf7TQsq5Va9h57bW:Jcm4FmowdHoSuTU5OXW
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/772-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-95-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2324-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-96-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2368-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1736-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-241-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2588-264-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2572-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-408-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/804-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-536-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/992-556-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/992-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-584-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2652-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-935-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-9097-0x0000000077720000-0x000000007781A000-memory.dmp family_blackmoon behavioral1/memory/2464-10100-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-11105-0x0000000077720000-0x000000007781A000-memory.dmp family_blackmoon behavioral1/memory/2464-13821-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-15208-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-17432-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-18539-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-20206-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon behavioral1/memory/2464-23283-0x0000000077600000-0x000000007771F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2576 ffxffxl.exe 288 u448804.exe 3012 40866.exe 1572 c664204.exe 2940 lllxlxf.exe 2784 04804.exe 3024 9nhntn.exe 3008 k82442.exe 2804 660840.exe 2648 82028.exe 2324 thnbhh.exe 2368 64266.exe 1724 djjvd.exe 2960 640442.exe 2840 dvjvd.exe 2856 0242822.exe 1924 fllfxlr.exe 340 nnhbnt.exe 1808 ntbtbt.exe 2452 60804.exe 2088 26424.exe 3052 6424868.exe 1168 ppvdd.exe 3036 0086086.exe 1332 vpdpv.exe 2320 i222068.exe 1636 dpvpp.exe 1736 xfrffxf.exe 1468 44088.exe 2604 1xlrflx.exe 2380 42800.exe 324 048606.exe 2588 bnthbn.exe 2572 fx02680.exe 356 60408.exe 1556 86402.exe 788 xxxlrxx.exe 1528 622002.exe 2268 844664.exe 2384 3flxfxx.exe 2296 ffffrrr.exe 2780 g6842.exe 2896 pvvpv.exe 3040 u820028.exe 2768 vvvdd.exe 2644 flfllxf.exe 2664 8828062.exe 2772 000486.exe 2944 66088.exe 2800 rhtthht.exe 2700 880206.exe 2756 88208.exe 604 xfrllll.exe 1056 1lrffrx.exe 1904 00404.exe 2836 pvddd.exe 1892 02844.exe 1268 u828646.exe 2964 62266.exe 1796 tbtthn.exe 804 7btnht.exe 1948 tnnttn.exe 1336 s4806.exe 1360 844220.exe -
resource yara_rule behavioral1/memory/772-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-6.dat upx behavioral1/files/0x000700000001870f-15.dat upx behavioral1/memory/2576-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018712-23.dat upx behavioral1/memory/3012-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018bc8-32.dat upx behavioral1/memory/1572-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000191f1-40.dat upx behavioral1/files/0x0006000000019244-47.dat upx behavioral1/memory/2784-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001924a-55.dat upx behavioral1/memory/3024-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019259-62.dat upx behavioral1/files/0x000800000001925d-71.dat upx behavioral1/memory/3008-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a4-78.dat upx behavioral1/memory/2804-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ba-88.dat upx behavioral1/memory/2648-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-95-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2324-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001951c-97.dat upx behavioral1/memory/2368-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019524-106.dat upx behavioral1/files/0x00050000000195a6-112.dat upx behavioral1/memory/1724-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e5-123.dat upx behavioral1/memory/2960-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961c-130.dat upx behavioral1/files/0x000500000001961e-137.dat upx behavioral1/memory/2856-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019620-145.dat upx behavioral1/memory/340-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019621-152.dat upx behavioral1/files/0x0005000000019622-161.dat upx behavioral1/memory/2452-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-168.dat upx behavioral1/memory/2088-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018660-177.dat upx behavioral1/memory/3052-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019626-184.dat upx behavioral1/files/0x0005000000019628-193.dat upx behavioral1/memory/3036-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001962a-199.dat upx behavioral1/memory/3036-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-204-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001963a-208.dat upx behavioral1/memory/2320-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001967e-216.dat upx behavioral1/memory/1636-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196bf-225.dat upx behavioral1/memory/1736-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019702-232.dat upx behavioral1/files/0x0005000000019994-238.dat upx behavioral1/files/0x0005000000019c50-248.dat upx behavioral1/files/0x0005000000019c51-255.dat upx behavioral1/memory/2572-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1556-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-291-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 000684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60408.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6202648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4024426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 772 wrote to memory of 2576 772 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 30 PID 772 wrote to memory of 2576 772 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 30 PID 772 wrote to memory of 2576 772 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 30 PID 772 wrote to memory of 2576 772 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 30 PID 2576 wrote to memory of 288 2576 ffxffxl.exe 31 PID 2576 wrote to memory of 288 2576 ffxffxl.exe 31 PID 2576 wrote to memory of 288 2576 ffxffxl.exe 31 PID 2576 wrote to memory of 288 2576 ffxffxl.exe 31 PID 288 wrote to memory of 3012 288 u448804.exe 32 PID 288 wrote to memory of 3012 288 u448804.exe 32 PID 288 wrote to memory of 3012 288 u448804.exe 32 PID 288 wrote to memory of 3012 288 u448804.exe 32 PID 3012 wrote to memory of 1572 3012 40866.exe 33 PID 3012 wrote to memory of 1572 3012 40866.exe 33 PID 3012 wrote to memory of 1572 3012 40866.exe 33 PID 3012 wrote to memory of 1572 3012 40866.exe 33 PID 1572 wrote to memory of 2940 1572 c664204.exe 34 PID 1572 wrote to memory of 2940 1572 c664204.exe 34 PID 1572 wrote to memory of 2940 1572 c664204.exe 34 PID 1572 wrote to memory of 2940 1572 c664204.exe 34 PID 2940 wrote to memory of 2784 2940 lllxlxf.exe 35 PID 2940 wrote to memory of 2784 2940 lllxlxf.exe 35 PID 2940 wrote to memory of 2784 2940 lllxlxf.exe 35 PID 2940 wrote to memory of 2784 2940 lllxlxf.exe 35 PID 2784 wrote to memory of 3024 2784 04804.exe 36 PID 2784 wrote to memory of 3024 2784 04804.exe 36 PID 2784 wrote to memory of 3024 2784 04804.exe 36 PID 2784 wrote to memory of 3024 2784 04804.exe 36 PID 3024 wrote to memory of 3008 3024 9nhntn.exe 37 PID 3024 wrote to memory of 3008 3024 9nhntn.exe 37 PID 3024 wrote to memory of 3008 3024 9nhntn.exe 37 PID 3024 wrote to memory of 3008 3024 9nhntn.exe 37 PID 3008 wrote to memory of 2804 3008 k82442.exe 38 PID 3008 wrote to memory of 2804 3008 k82442.exe 38 PID 3008 wrote to memory of 2804 3008 k82442.exe 38 PID 3008 wrote to memory of 2804 3008 k82442.exe 38 PID 2804 wrote to memory of 2648 2804 660840.exe 39 PID 2804 wrote to memory of 2648 2804 660840.exe 39 PID 2804 wrote to memory of 2648 2804 660840.exe 39 PID 2804 wrote to memory of 2648 2804 660840.exe 39 PID 2648 wrote to memory of 2324 2648 82028.exe 40 PID 2648 wrote to memory of 2324 2648 82028.exe 40 PID 2648 wrote to memory of 2324 2648 82028.exe 40 PID 2648 wrote to memory of 2324 2648 82028.exe 40 PID 2324 wrote to memory of 2368 2324 thnbhh.exe 41 PID 2324 wrote to memory of 2368 2324 thnbhh.exe 41 PID 2324 wrote to memory of 2368 2324 thnbhh.exe 41 PID 2324 wrote to memory of 2368 2324 thnbhh.exe 41 PID 2368 wrote to memory of 1724 2368 64266.exe 42 PID 2368 wrote to memory of 1724 2368 64266.exe 42 PID 2368 wrote to memory of 1724 2368 64266.exe 42 PID 2368 wrote to memory of 1724 2368 64266.exe 42 PID 1724 wrote to memory of 2960 1724 djjvd.exe 43 PID 1724 wrote to memory of 2960 1724 djjvd.exe 43 PID 1724 wrote to memory of 2960 1724 djjvd.exe 43 PID 1724 wrote to memory of 2960 1724 djjvd.exe 43 PID 2960 wrote to memory of 2840 2960 640442.exe 44 PID 2960 wrote to memory of 2840 2960 640442.exe 44 PID 2960 wrote to memory of 2840 2960 640442.exe 44 PID 2960 wrote to memory of 2840 2960 640442.exe 44 PID 2840 wrote to memory of 2856 2840 dvjvd.exe 45 PID 2840 wrote to memory of 2856 2840 dvjvd.exe 45 PID 2840 wrote to memory of 2856 2840 dvjvd.exe 45 PID 2840 wrote to memory of 2856 2840 dvjvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\ffxffxl.exec:\ffxffxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\u448804.exec:\u448804.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\40866.exec:\40866.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\c664204.exec:\c664204.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\lllxlxf.exec:\lllxlxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\04804.exec:\04804.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9nhntn.exec:\9nhntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\k82442.exec:\k82442.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\660840.exec:\660840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\82028.exec:\82028.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\thnbhh.exec:\thnbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\64266.exec:\64266.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\djjvd.exec:\djjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\640442.exec:\640442.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\dvjvd.exec:\dvjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\0242822.exec:\0242822.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fllfxlr.exec:\fllfxlr.exe18⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nnhbnt.exec:\nnhbnt.exe19⤵
- Executes dropped EXE
PID:340 -
\??\c:\ntbtbt.exec:\ntbtbt.exe20⤵
- Executes dropped EXE
PID:1808 -
\??\c:\60804.exec:\60804.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\26424.exec:\26424.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\6424868.exec:\6424868.exe23⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppvdd.exec:\ppvdd.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\0086086.exec:\0086086.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpdpv.exec:\vpdpv.exe26⤵
- Executes dropped EXE
PID:1332 -
\??\c:\i222068.exec:\i222068.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dpvpp.exec:\dpvpp.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xfrffxf.exec:\xfrffxf.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\44088.exec:\44088.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\1xlrflx.exec:\1xlrflx.exe31⤵
- Executes dropped EXE
PID:2604 -
\??\c:\42800.exec:\42800.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\048606.exec:\048606.exe33⤵
- Executes dropped EXE
PID:324 -
\??\c:\bnthbn.exec:\bnthbn.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fx02680.exec:\fx02680.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\60408.exec:\60408.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:356 -
\??\c:\86402.exec:\86402.exe37⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxxlrxx.exec:\xxxlrxx.exe38⤵
- Executes dropped EXE
PID:788 -
\??\c:\622002.exec:\622002.exe39⤵
- Executes dropped EXE
PID:1528 -
\??\c:\844664.exec:\844664.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3flxfxx.exec:\3flxfxx.exe41⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ffffrrr.exec:\ffffrrr.exe42⤵
- Executes dropped EXE
PID:2296 -
\??\c:\g6842.exec:\g6842.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pvvpv.exec:\pvvpv.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\u820028.exec:\u820028.exe45⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vvvdd.exec:\vvvdd.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\flfllxf.exec:\flfllxf.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\8828062.exec:\8828062.exe48⤵
- Executes dropped EXE
PID:2664 -
\??\c:\000486.exec:\000486.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\66088.exec:\66088.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rhtthht.exec:\rhtthht.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\880206.exec:\880206.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\88208.exec:\88208.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xfrllll.exec:\xfrllll.exe54⤵
- Executes dropped EXE
PID:604 -
\??\c:\1lrffrx.exec:\1lrffrx.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\00404.exec:\00404.exe56⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pvddd.exec:\pvddd.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\02844.exec:\02844.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\u828646.exec:\u828646.exe59⤵
- Executes dropped EXE
PID:1268 -
\??\c:\62266.exec:\62266.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tbtthn.exec:\tbtthn.exe61⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7btnht.exec:\7btnht.exe62⤵
- Executes dropped EXE
PID:804 -
\??\c:\tnnttn.exec:\tnnttn.exe63⤵
- Executes dropped EXE
PID:1948 -
\??\c:\s4806.exec:\s4806.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\844220.exec:\844220.exe65⤵
- Executes dropped EXE
PID:1360 -
\??\c:\fllxlxf.exec:\fllxlxf.exe66⤵PID:3048
-
\??\c:\hhbbbb.exec:\hhbbbb.exe67⤵PID:560
-
\??\c:\1jjvv.exec:\1jjvv.exe68⤵PID:1100
-
\??\c:\3lfflff.exec:\3lfflff.exe69⤵PID:1168
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe70⤵PID:1856
-
\??\c:\60286.exec:\60286.exe71⤵PID:1804
-
\??\c:\262024.exec:\262024.exe72⤵PID:2068
-
\??\c:\4862224.exec:\4862224.exe73⤵PID:1620
-
\??\c:\tnbbhn.exec:\tnbbhn.exe74⤵PID:2028
-
\??\c:\044602.exec:\044602.exe75⤵PID:908
-
\??\c:\tnhtht.exec:\tnhtht.exe76⤵PID:1288
-
\??\c:\0220604.exec:\0220604.exe77⤵PID:1912
-
\??\c:\k82444.exec:\k82444.exe78⤵PID:1468
-
\??\c:\2840662.exec:\2840662.exe79⤵PID:2564
-
\??\c:\e60224.exec:\e60224.exe80⤵PID:2108
-
\??\c:\0482464.exec:\0482464.exe81⤵PID:2544
-
\??\c:\pppdp.exec:\pppdp.exe82⤵PID:1564
-
\??\c:\vpjjv.exec:\vpjjv.exe83⤵PID:884
-
\??\c:\pvppj.exec:\pvppj.exe84⤵PID:2720
-
\??\c:\6002620.exec:\6002620.exe85⤵PID:2464
-
\??\c:\rxlxfff.exec:\rxlxfff.exe86⤵PID:1556
-
\??\c:\nhntnt.exec:\nhntnt.exe87⤵PID:1628
-
\??\c:\g6422.exec:\g6422.exe88⤵PID:992
-
\??\c:\880246.exec:\880246.exe89⤵PID:2264
-
\??\c:\0088604.exec:\0088604.exe90⤵PID:2504
-
\??\c:\60240.exec:\60240.exe91⤵PID:2740
-
\??\c:\nnbbhh.exec:\nnbbhh.exe92⤵PID:2792
-
\??\c:\i202026.exec:\i202026.exe93⤵PID:2788
-
\??\c:\jdjdv.exec:\jdjdv.exe94⤵PID:2892
-
\??\c:\60860.exec:\60860.exe95⤵PID:2908
-
\??\c:\6660420.exec:\6660420.exe96⤵PID:2000
-
\??\c:\ttnnht.exec:\ttnnht.exe97⤵PID:2664
-
\??\c:\20206.exec:\20206.exe98⤵PID:2636
-
\??\c:\pjvjj.exec:\pjvjj.exe99⤵PID:2652
-
\??\c:\6202648.exec:\6202648.exe100⤵
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\826484.exec:\826484.exe101⤵PID:2192
-
\??\c:\e06486.exec:\e06486.exe102⤵PID:2904
-
\??\c:\6226026.exec:\6226026.exe103⤵PID:2368
-
\??\c:\04888.exec:\04888.exe104⤵PID:1196
-
\??\c:\bhbnhn.exec:\bhbnhn.exe105⤵PID:2960
-
\??\c:\lfrlrxx.exec:\lfrlrxx.exe106⤵PID:2836
-
\??\c:\040864.exec:\040864.exe107⤵PID:2876
-
\??\c:\06448.exec:\06448.exe108⤵PID:1268
-
\??\c:\rrrxxlx.exec:\rrrxxlx.exe109⤵PID:1748
-
\??\c:\ppvpj.exec:\ppvpj.exe110⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\4048822.exec:\4048822.exe111⤵PID:1868
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe112⤵PID:2316
-
\??\c:\w06484.exec:\w06484.exe113⤵PID:1336
-
\??\c:\u426862.exec:\u426862.exe114⤵PID:1648
-
\??\c:\2022620.exec:\2022620.exe115⤵PID:2524
-
\??\c:\9nhnth.exec:\9nhnth.exe116⤵PID:1756
-
\??\c:\6624420.exec:\6624420.exe117⤵PID:2828
-
\??\c:\66048.exec:\66048.exe118⤵PID:1284
-
\??\c:\4620606.exec:\4620606.exe119⤵PID:1460
-
\??\c:\46204.exec:\46204.exe120⤵PID:1332
-
\??\c:\bttbtn.exec:\bttbtn.exe121⤵PID:1716
-
\??\c:\vvjdp.exec:\vvjdp.exe122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-