Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 20:32
Behavioral task
behavioral1
Sample
00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe
-
Size
98KB
-
MD5
00744cfd58a0aa6588267fd05c53d4ba
-
SHA1
419914f07d6163b8d815ac7deeee4ef954490fda
-
SHA256
6382bfeedc9194d374928545855e9917933b9e1d0a158574cf0d416d7cf63a56
-
SHA512
be08cfd76248b1377a6cb1c6bf003a74a2cf3043f6f979bbccb781cf389a73cf62e0b88df62de84b05760bced908275f12bc2ffe9ab9bf0ae6d9ae16a27f3b59
-
SSDEEP
3072:JhOmTsF93UYfwC6GIoutWFf7TQsq5Va9h57bW:Jcm4FmowdHoSuTU5OXW
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/32-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/568-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/704-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 220 tbnbnn.exe 1868 djjpd.exe 4596 lxxxrrx.exe 1228 thhbnb.exe 1216 5ppjj.exe 212 xllfrlf.exe 32 nttthn.exe 1704 nnnhbb.exe 1604 vvddj.exe 1836 llrxxff.exe 3444 bhnhhh.exe 4552 bntnhh.exe 5100 dddpd.exe 2008 lxlrxfl.exe 3760 hnbnhb.exe 4032 ppdjj.exe 4616 rlrrrrx.exe 2340 nnttnn.exe 2816 jdddd.exe 4720 xllrlfr.exe 3380 ffxxrxr.exe 672 nhtnht.exe 876 vjppp.exe 3212 llrfllf.exe 4944 xxlllll.exe 1352 nnnhbb.exe 1556 7jdjj.exe 3516 rfrrxll.exe 4604 lxfllxl.exe 4012 bntttn.exe 64 vpdvj.exe 1552 9fxlrrf.exe 1336 nnhnnt.exe 4568 pdvvj.exe 2472 vpddd.exe 3576 3xxfrfr.exe 1656 rlllllr.exe 4732 bntttb.exe 3152 pjdvd.exe 4640 jvdvv.exe 5092 3xlffll.exe 704 bttnnn.exe 4432 3hbbbh.exe 3296 jdvvp.exe 568 xrxxrxx.exe 2356 xfrrfxl.exe 3508 nbhhth.exe 2512 9jdvv.exe 2460 fffflrx.exe 1328 1rrrrff.exe 3968 hhhhtt.exe 32 bnnhhh.exe 4592 ppvpd.exe 4540 vjvpd.exe 868 frlrlxr.exe 4580 bbhhhn.exe 2508 ttntnh.exe 3712 jvppv.exe 4552 xlllfll.exe 3316 rrfllxx.exe 1620 nntnht.exe 920 pdjjp.exe 1584 vpjpp.exe 4032 fxrflrf.exe -
resource yara_rule behavioral2/memory/3716-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a3-11.dat upx behavioral2/files/0x00070000000234a4-12.dat upx behavioral2/files/0x00070000000234a5-21.dat upx behavioral2/files/0x00070000000234a7-29.dat upx behavioral2/memory/32-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ad-60.dat upx behavioral2/files/0x00070000000234ae-65.dat upx behavioral2/files/0x00070000000234af-70.dat upx behavioral2/memory/4032-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b4-87.dat upx behavioral2/files/0x00070000000234b5-94.dat upx behavioral2/files/0x00070000000234b6-99.dat upx behavioral2/memory/3380-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234be-145.dat upx behavioral2/files/0x00070000000234c0-155.dat upx behavioral2/memory/1336-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1656-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4732-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3152-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3508-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1140-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3680-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4568-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2808-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3304-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4092-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1992-380-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-405-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1420-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3996-543-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4592-556-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5056-561-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/528-597-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3236-588-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/920-581-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1520-580-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4244-540-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1900-529-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5020-504-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-497-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4208-490-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-473-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5068-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3080-451-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-440-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1420-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-417-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4440-408-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3564-371-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1584-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3444-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2808-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1808-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4344-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2072-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4784-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4456-271-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 220 3716 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 84 PID 3716 wrote to memory of 220 3716 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 84 PID 3716 wrote to memory of 220 3716 00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe 84 PID 220 wrote to memory of 1868 220 tbnbnn.exe 186 PID 220 wrote to memory of 1868 220 tbnbnn.exe 186 PID 220 wrote to memory of 1868 220 tbnbnn.exe 186 PID 1868 wrote to memory of 4596 1868 djjpd.exe 86 PID 1868 wrote to memory of 4596 1868 djjpd.exe 86 PID 1868 wrote to memory of 4596 1868 djjpd.exe 86 PID 4596 wrote to memory of 1228 4596 lxxxrrx.exe 87 PID 4596 wrote to memory of 1228 4596 lxxxrrx.exe 87 PID 4596 wrote to memory of 1228 4596 lxxxrrx.exe 87 PID 1228 wrote to memory of 1216 1228 thhbnb.exe 88 PID 1228 wrote to memory of 1216 1228 thhbnb.exe 88 PID 1228 wrote to memory of 1216 1228 thhbnb.exe 88 PID 1216 wrote to memory of 212 1216 5ppjj.exe 89 PID 1216 wrote to memory of 212 1216 5ppjj.exe 89 PID 1216 wrote to memory of 212 1216 5ppjj.exe 89 PID 212 wrote to memory of 32 212 xllfrlf.exe 551 PID 212 wrote to memory of 32 212 xllfrlf.exe 551 PID 212 wrote to memory of 32 212 xllfrlf.exe 551 PID 32 wrote to memory of 1704 32 nttthn.exe 92 PID 32 wrote to memory of 1704 32 nttthn.exe 92 PID 32 wrote to memory of 1704 32 nttthn.exe 92 PID 1704 wrote to memory of 1604 1704 nnnhbb.exe 93 PID 1704 wrote to memory of 1604 1704 nnnhbb.exe 93 PID 1704 wrote to memory of 1604 1704 nnnhbb.exe 93 PID 1604 wrote to memory of 1836 1604 vvddj.exe 696 PID 1604 wrote to memory of 1836 1604 vvddj.exe 696 PID 1604 wrote to memory of 1836 1604 vvddj.exe 696 PID 1836 wrote to memory of 3444 1836 llrxxff.exe 197 PID 1836 wrote to memory of 3444 1836 llrxxff.exe 197 PID 1836 wrote to memory of 3444 1836 llrxxff.exe 197 PID 3444 wrote to memory of 4552 3444 bhnhhh.exe 96 PID 3444 wrote to memory of 4552 3444 bhnhhh.exe 96 PID 3444 wrote to memory of 4552 3444 bhnhhh.exe 96 PID 4552 wrote to memory of 5100 4552 bntnhh.exe 97 PID 4552 wrote to memory of 5100 4552 bntnhh.exe 97 PID 4552 wrote to memory of 5100 4552 bntnhh.exe 97 PID 5100 wrote to memory of 2008 5100 dddpd.exe 98 PID 5100 wrote to memory of 2008 5100 dddpd.exe 98 PID 5100 wrote to memory of 2008 5100 dddpd.exe 98 PID 2008 wrote to memory of 3760 2008 lxlrxfl.exe 99 PID 2008 wrote to memory of 3760 2008 lxlrxfl.exe 99 PID 2008 wrote to memory of 3760 2008 lxlrxfl.exe 99 PID 3760 wrote to memory of 4032 3760 hnbnhb.exe 100 PID 3760 wrote to memory of 4032 3760 hnbnhb.exe 100 PID 3760 wrote to memory of 4032 3760 hnbnhb.exe 100 PID 4032 wrote to memory of 4616 4032 ppdjj.exe 102 PID 4032 wrote to memory of 4616 4032 ppdjj.exe 102 PID 4032 wrote to memory of 4616 4032 ppdjj.exe 102 PID 4616 wrote to memory of 2340 4616 rlrrrrx.exe 103 PID 4616 wrote to memory of 2340 4616 rlrrrrx.exe 103 PID 4616 wrote to memory of 2340 4616 rlrrrrx.exe 103 PID 2340 wrote to memory of 2816 2340 nnttnn.exe 104 PID 2340 wrote to memory of 2816 2340 nnttnn.exe 104 PID 2340 wrote to memory of 2816 2340 nnttnn.exe 104 PID 2816 wrote to memory of 4720 2816 jdddd.exe 105 PID 2816 wrote to memory of 4720 2816 jdddd.exe 105 PID 2816 wrote to memory of 4720 2816 jdddd.exe 105 PID 4720 wrote to memory of 3380 4720 xllrlfr.exe 106 PID 4720 wrote to memory of 3380 4720 xllrlfr.exe 106 PID 4720 wrote to memory of 3380 4720 xllrlfr.exe 106 PID 3380 wrote to memory of 672 3380 ffxxrxr.exe 416
Processes
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv efRUKA/LSUKa1dGsYhB0tg.01⤵PID:4584
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00744cfd58a0aa6588267fd05c53d4ba_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\tbnbnn.exec:\tbnbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\djjpd.exec:\djjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\lxxxrrx.exec:\lxxxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\thhbnb.exec:\thhbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\5ppjj.exec:\5ppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\xllfrlf.exec:\xllfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\nttthn.exec:\nttthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\nnnhbb.exec:\nnnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vvddj.exec:\vvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\llrxxff.exec:\llrxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\bhnhhh.exec:\bhnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\bntnhh.exec:\bntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\dddpd.exec:\dddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\hnbnhb.exec:\hnbnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\ppdjj.exec:\ppdjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nnttnn.exec:\nnttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jdddd.exec:\jdddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xllrlfr.exec:\xllrlfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\nhtnht.exec:\nhtnht.exe23⤵
- Executes dropped EXE
PID:672 -
\??\c:\vjppp.exec:\vjppp.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\llrfllf.exec:\llrfllf.exe25⤵
- Executes dropped EXE
PID:3212 -
\??\c:\xxlllll.exec:\xxlllll.exe26⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nnnhbb.exec:\nnnhbb.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\7jdjj.exec:\7jdjj.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rfrrxll.exec:\rfrrxll.exe29⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lxfllxl.exec:\lxfllxl.exe30⤵
- Executes dropped EXE
PID:4604 -
\??\c:\bntttn.exec:\bntttn.exe31⤵
- Executes dropped EXE
PID:4012 -
\??\c:\vpdvj.exec:\vpdvj.exe32⤵
- Executes dropped EXE
PID:64 -
\??\c:\9fxlrrf.exec:\9fxlrrf.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nnhnnt.exec:\nnhnnt.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pdvvj.exec:\pdvvj.exe35⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vpddd.exec:\vpddd.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\3xxfrfr.exec:\3xxfrfr.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rlllllr.exec:\rlllllr.exe38⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bntttb.exec:\bntttb.exe39⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjdvd.exec:\pjdvd.exe40⤵
- Executes dropped EXE
PID:3152 -
\??\c:\jvdvv.exec:\jvdvv.exe41⤵
- Executes dropped EXE
PID:4640 -
\??\c:\3xlffll.exec:\3xlffll.exe42⤵
- Executes dropped EXE
PID:5092 -
\??\c:\bttnnn.exec:\bttnnn.exe43⤵
- Executes dropped EXE
PID:704 -
\??\c:\3hbbbh.exec:\3hbbbh.exe44⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdvvp.exec:\jdvvp.exe45⤵
- Executes dropped EXE
PID:3296 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\xfrrfxl.exec:\xfrrfxl.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nbhhth.exec:\nbhhth.exe48⤵
- Executes dropped EXE
PID:3508 -
\??\c:\9jdvv.exec:\9jdvv.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\fffflrx.exec:\fffflrx.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1rrrrff.exec:\1rrrrff.exe51⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hhhhtt.exec:\hhhhtt.exe52⤵
- Executes dropped EXE
PID:3968 -
\??\c:\bnnhhh.exec:\bnnhhh.exe53⤵
- Executes dropped EXE
PID:32 -
\??\c:\ppvpd.exec:\ppvpd.exe54⤵
- Executes dropped EXE
PID:4592 -
\??\c:\vjvpd.exec:\vjvpd.exe55⤵
- Executes dropped EXE
PID:4540 -
\??\c:\frlrlxr.exec:\frlrlxr.exe56⤵
- Executes dropped EXE
PID:868 -
\??\c:\bbhhhn.exec:\bbhhhn.exe57⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ttntnh.exec:\ttntnh.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvppv.exec:\jvppv.exe59⤵
- Executes dropped EXE
PID:3712 -
\??\c:\xlllfll.exec:\xlllfll.exe60⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rrfllxx.exec:\rrfllxx.exe61⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nntnht.exec:\nntnht.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdjjp.exec:\pdjjp.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\vpjpp.exec:\vpjpp.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fxrflrf.exec:\fxrflrf.exe65⤵
- Executes dropped EXE
PID:4032 -
\??\c:\htnhbt.exec:\htnhbt.exe66⤵PID:3360
-
\??\c:\bththn.exec:\bththn.exe67⤵PID:4256
-
\??\c:\ddjpp.exec:\ddjpp.exe68⤵PID:2308
-
\??\c:\ddpvv.exec:\ddpvv.exe69⤵PID:1844
-
\??\c:\xxrlxrx.exec:\xxrlxrx.exe70⤵PID:4208
-
\??\c:\xxrllrr.exec:\xxrllrr.exe71⤵PID:368
-
\??\c:\bbhhbt.exec:\bbhhbt.exe72⤵PID:2172
-
\??\c:\tthhnn.exec:\tthhnn.exe73⤵PID:1140
-
\??\c:\vvjjj.exec:\vvjjj.exe74⤵PID:4792
-
\??\c:\xxlllfl.exec:\xxlllfl.exe75⤵PID:1352
-
\??\c:\3ttnbb.exec:\3ttnbb.exe76⤵PID:4456
-
\??\c:\bthhhh.exec:\bthhhh.exe77⤵PID:2968
-
\??\c:\vdvpj.exec:\vdvpj.exe78⤵PID:4656
-
\??\c:\jvddv.exec:\jvddv.exe79⤵PID:4604
-
\??\c:\xlrffff.exec:\xlrffff.exe80⤵PID:660
-
\??\c:\lfllrrf.exec:\lfllrrf.exe81⤵PID:2492
-
\??\c:\bhbbhb.exec:\bhbbhb.exe82⤵PID:4784
-
\??\c:\5vppv.exec:\5vppv.exe83⤵PID:2072
-
\??\c:\7lxxrll.exec:\7lxxrll.exe84⤵PID:396
-
\??\c:\xxxffrr.exec:\xxxffrr.exe85⤵PID:3320
-
\??\c:\bttnth.exec:\bttnth.exe86⤵PID:1060
-
\??\c:\tbtnht.exec:\tbtnht.exe87⤵PID:4568
-
\??\c:\vdpvj.exec:\vdpvj.exe88⤵PID:3680
-
\??\c:\lxllrxf.exec:\lxllrxf.exe89⤵PID:3576
-
\??\c:\fxrflfl.exec:\fxrflfl.exe90⤵PID:4344
-
\??\c:\ttbhhh.exec:\ttbhhh.exe91⤵
- System Location Discovery: System Language Discovery
PID:3448 -
\??\c:\lfffxfx.exec:\lfffxfx.exe92⤵PID:3844
-
\??\c:\xfrlxlx.exec:\xfrlxlx.exe93⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\9tnnbn.exec:\9tnnbn.exe94⤵PID:3208
-
\??\c:\3jddd.exec:\3jddd.exe95⤵PID:4332
-
\??\c:\1vvvp.exec:\1vvvp.exe96⤵PID:1632
-
\??\c:\rrrrfff.exec:\rrrrfff.exe97⤵PID:1808
-
\??\c:\rfxfxff.exec:\rfxfxff.exe98⤵PID:4448
-
\??\c:\bbthtt.exec:\bbthtt.exe99⤵PID:2808
-
\??\c:\tbbbtt.exec:\tbbbtt.exe100⤵PID:2400
-
\??\c:\jdvvp.exec:\jdvvp.exe101⤵PID:1392
-
\??\c:\lflrrrl.exec:\lflrrrl.exe102⤵PID:4968
-
\??\c:\nnnhbb.exec:\nnnhbb.exe103⤵PID:2076
-
\??\c:\htthbb.exec:\htthbb.exe104⤵PID:1208
-
\??\c:\3jpvd.exec:\3jpvd.exe105⤵PID:3304
-
\??\c:\3lfrflx.exec:\3lfrflx.exe106⤵PID:3300
-
\??\c:\rlfffrl.exec:\rlfffrl.exe107⤵PID:3460
-
\??\c:\bthbtt.exec:\bthbtt.exe108⤵PID:2984
-
\??\c:\ddddv.exec:\ddddv.exe109⤵PID:4608
-
\??\c:\jvjvv.exec:\jvjvv.exe110⤵PID:3444
-
\??\c:\frfrfff.exec:\frfrfff.exe111⤵PID:3028
-
\??\c:\hhhthn.exec:\hhhthn.exe112⤵PID:1992
-
\??\c:\hnhthb.exec:\hnhthb.exe113⤵PID:4092
-
\??\c:\pdpdv.exec:\pdpdv.exe114⤵PID:3760
-
\??\c:\llxflfr.exec:\llxflfr.exe115⤵PID:1908
-
\??\c:\lrrxrxx.exec:\lrrxrxx.exe116⤵PID:1584
-
\??\c:\hhhhbn.exec:\hhhhbn.exe117⤵PID:3564
-
\??\c:\hbbhbn.exec:\hbbhbn.exe118⤵PID:3360
-
\??\c:\ddvjj.exec:\ddvjj.exe119⤵PID:4256
-
\??\c:\ddjdd.exec:\ddjdd.exe120⤵PID:4160
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe121⤵PID:4192
-
\??\c:\lffflrr.exec:\lffflrr.exe122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-