Analysis
-
max time kernel
136s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe
-
Size
196KB
-
MD5
0098d5aebfa024ab5320c9187b45e091
-
SHA1
2f9d9d79f70a725c58060630d6c508ef589db3a6
-
SHA256
475e3ebe1e56ffdf5408e39607ef343c612470556c780b959a4b909da60421ea
-
SHA512
e928cdbae0b85e89ece23024b9e97d80b5b56da4f5e7c865a1f2740b364e41a678103bf365781a4881331c49681d05e2687cacbaee3c5fca50a928dd7e59368f
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqy1ce7q:PhOm2sI93UufdC67cih/u
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/948-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-1080-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2488-1239-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2484-1014-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-915-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2468-794-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/552-713-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-681-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-623-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-552-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1012-495-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 948 fxfxflx.exe 2256 ppjpd.exe 2848 rlrxrff.exe 2788 1bthnh.exe 300 tbbhht.exe 2948 pvjjv.exe 2700 vjdvj.exe 2720 lrlllff.exe 2060 bhnntn.exe 2992 vpppp.exe 2532 vpjpp.exe 1020 flrlrrr.exe 2712 bbbtnb.exe 2884 pvjpp.exe 2224 xlfxxxr.exe 2960 htntbt.exe 2084 dppdd.exe 1676 vjjjp.exe 1968 flrlrlr.exe 2280 hhhtnb.exe 1936 hnnnhn.exe 2284 vddjp.exe 2296 lfffxxf.exe 2152 btthbn.exe 1420 ddjjv.exe 2336 xxrrfll.exe 1444 nnbnht.exe 1556 1pdvj.exe 832 vvvvv.exe 1956 flrfrll.exe 2504 nnhnbh.exe 896 vjdjp.exe 1976 rxfrfll.exe 2340 nbnhhh.exe 948 vjdjv.exe 2876 djdpp.exe 2748 fxrlrfl.exe 2924 ttnbhb.exe 2496 nttnnh.exe 2948 vddvj.exe 2188 jddvj.exe 2776 rxlffxx.exe 2984 lrxllxx.exe 2604 bhnntn.exe 2912 tbnnhh.exe 2100 djdvp.exe 2672 lrrlxlx.exe 2440 hhbbnn.exe 2884 1bnbhn.exe 2744 3vvdv.exe 2508 1vpdj.exe 1804 xrrfrxl.exe 412 fllllff.exe 1464 nnbtth.exe 2632 3bhbbn.exe 2172 pvdvj.exe 3004 fxrfxlx.exe 2432 xrflxfx.exe 1760 llxxllf.exe 1948 thbbtt.exe 2484 btntnb.exe 2252 fxxxxlx.exe 2068 lxrlrlr.exe 1012 bhbthb.exe -
resource yara_rule behavioral1/memory/1692-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-578-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-661-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-700-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-756-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-781-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-803-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-880-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-938-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-1080-0x00000000002B0000-0x00000000002D9000-memory.dmp upx behavioral1/memory/2992-1163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-1393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-1350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-1337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-1143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-1130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-1098-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-1039-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-1014-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-1001-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-976-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-963-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-854-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-841-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/552-713-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-681-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-623-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-585-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-565-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-552-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-508-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1012-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-454-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-290-0x0000000077330000-0x000000007744F000-memory.dmp upx behavioral1/memory/832-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 948 1692 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 64 PID 1692 wrote to memory of 948 1692 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 64 PID 1692 wrote to memory of 948 1692 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 64 PID 1692 wrote to memory of 948 1692 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 64 PID 948 wrote to memory of 2256 948 fxfxflx.exe 320 PID 948 wrote to memory of 2256 948 fxfxflx.exe 320 PID 948 wrote to memory of 2256 948 fxfxflx.exe 320 PID 948 wrote to memory of 2256 948 fxfxflx.exe 320 PID 2256 wrote to memory of 2848 2256 ppjpd.exe 31 PID 2256 wrote to memory of 2848 2256 ppjpd.exe 31 PID 2256 wrote to memory of 2848 2256 ppjpd.exe 31 PID 2256 wrote to memory of 2848 2256 ppjpd.exe 31 PID 2848 wrote to memory of 2788 2848 rlrxrff.exe 32 PID 2848 wrote to memory of 2788 2848 rlrxrff.exe 32 PID 2848 wrote to memory of 2788 2848 rlrxrff.exe 32 PID 2848 wrote to memory of 2788 2848 rlrxrff.exe 32 PID 2788 wrote to memory of 300 2788 1bthnh.exe 33 PID 2788 wrote to memory of 300 2788 1bthnh.exe 33 PID 2788 wrote to memory of 300 2788 1bthnh.exe 33 PID 2788 wrote to memory of 300 2788 1bthnh.exe 33 PID 300 wrote to memory of 2948 300 tbbhht.exe 69 PID 300 wrote to memory of 2948 300 tbbhht.exe 69 PID 300 wrote to memory of 2948 300 tbbhht.exe 69 PID 300 wrote to memory of 2948 300 tbbhht.exe 69 PID 2948 wrote to memory of 2700 2948 pvjjv.exe 35 PID 2948 wrote to memory of 2700 2948 pvjjv.exe 35 PID 2948 wrote to memory of 2700 2948 pvjjv.exe 35 PID 2948 wrote to memory of 2700 2948 pvjjv.exe 35 PID 2700 wrote to memory of 2720 2700 vjdvj.exe 36 PID 2700 wrote to memory of 2720 2700 vjdvj.exe 36 PID 2700 wrote to memory of 2720 2700 vjdvj.exe 36 PID 2700 wrote to memory of 2720 2700 vjdvj.exe 36 PID 2720 wrote to memory of 2060 2720 lrlllff.exe 37 PID 2720 wrote to memory of 2060 2720 lrlllff.exe 37 PID 2720 wrote to memory of 2060 2720 lrlllff.exe 37 PID 2720 wrote to memory of 2060 2720 lrlllff.exe 37 PID 2060 wrote to memory of 2992 2060 bhnntn.exe 38 PID 2060 wrote to memory of 2992 2060 bhnntn.exe 38 PID 2060 wrote to memory of 2992 2060 bhnntn.exe 38 PID 2060 wrote to memory of 2992 2060 bhnntn.exe 38 PID 2992 wrote to memory of 2532 2992 vpppp.exe 39 PID 2992 wrote to memory of 2532 2992 vpppp.exe 39 PID 2992 wrote to memory of 2532 2992 vpppp.exe 39 PID 2992 wrote to memory of 2532 2992 vpppp.exe 39 PID 2532 wrote to memory of 1020 2532 vpjpp.exe 40 PID 2532 wrote to memory of 1020 2532 vpjpp.exe 40 PID 2532 wrote to memory of 1020 2532 vpjpp.exe 40 PID 2532 wrote to memory of 1020 2532 vpjpp.exe 40 PID 1020 wrote to memory of 2712 1020 flrlrrr.exe 41 PID 1020 wrote to memory of 2712 1020 flrlrrr.exe 41 PID 1020 wrote to memory of 2712 1020 flrlrrr.exe 41 PID 1020 wrote to memory of 2712 1020 flrlrrr.exe 41 PID 2712 wrote to memory of 2884 2712 bbbtnb.exe 42 PID 2712 wrote to memory of 2884 2712 bbbtnb.exe 42 PID 2712 wrote to memory of 2884 2712 bbbtnb.exe 42 PID 2712 wrote to memory of 2884 2712 bbbtnb.exe 42 PID 2884 wrote to memory of 2224 2884 pvjpp.exe 43 PID 2884 wrote to memory of 2224 2884 pvjpp.exe 43 PID 2884 wrote to memory of 2224 2884 pvjpp.exe 43 PID 2884 wrote to memory of 2224 2884 pvjpp.exe 43 PID 2224 wrote to memory of 2960 2224 xlfxxxr.exe 44 PID 2224 wrote to memory of 2960 2224 xlfxxxr.exe 44 PID 2224 wrote to memory of 2960 2224 xlfxxxr.exe 44 PID 2224 wrote to memory of 2960 2224 xlfxxxr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\fxfxflx.exec:\fxfxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rlrxrff.exec:\rlrxrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1bthnh.exec:\1bthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tbbhht.exec:\tbbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\pvjjv.exec:\pvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\vjdvj.exec:\vjdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lrlllff.exec:\lrlllff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bhnntn.exec:\bhnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\vpppp.exec:\vpppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vpjpp.exec:\vpjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\flrlrrr.exec:\flrlrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\bbbtnb.exec:\bbbtnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pvjpp.exec:\pvjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\htntbt.exec:\htntbt.exe17⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dppdd.exec:\dppdd.exe18⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vjjjp.exec:\vjjjp.exe19⤵
- Executes dropped EXE
PID:1676 -
\??\c:\flrlrlr.exec:\flrlrlr.exe20⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hhhtnb.exec:\hhhtnb.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hnnnhn.exec:\hnnnhn.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vddjp.exec:\vddjp.exe23⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lfffxxf.exec:\lfffxxf.exe24⤵
- Executes dropped EXE
PID:2296 -
\??\c:\btthbn.exec:\btthbn.exe25⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ddjjv.exec:\ddjjv.exe26⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xxrrfll.exec:\xxrrfll.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnbnht.exec:\nnbnht.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1pdvj.exec:\1pdvj.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vvvvv.exec:\vvvvv.exe30⤵
- Executes dropped EXE
PID:832 -
\??\c:\flrfrll.exec:\flrfrll.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nnhnbh.exec:\nnhnbh.exe32⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vjdjp.exec:\vjdjp.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\rxfrfll.exec:\rxfrfll.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9bbnbn.exec:\9bbnbn.exe35⤵PID:1516
-
\??\c:\nbnhhh.exec:\nbnhhh.exe36⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vjdjv.exec:\vjdjv.exe37⤵
- Executes dropped EXE
PID:948 -
\??\c:\djdpp.exec:\djdpp.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fxrlrfl.exec:\fxrlrfl.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ttnbhb.exec:\ttnbhb.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nttnnh.exec:\nttnnh.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vddvj.exec:\vddvj.exe42⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jddvj.exec:\jddvj.exe43⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rxlffxx.exec:\rxlffxx.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrxllxx.exec:\lrxllxx.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bhnntn.exec:\bhnntn.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tbnnhh.exec:\tbnnhh.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\djdvp.exec:\djdvp.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lrrlxlx.exec:\lrrlxlx.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hhbbnn.exec:\hhbbnn.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1bnbhn.exec:\1bnbhn.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3vvdv.exec:\3vvdv.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1vpdj.exec:\1vpdj.exe53⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe54⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fllllff.exec:\fllllff.exe55⤵
- Executes dropped EXE
PID:412 -
\??\c:\nnbtth.exec:\nnbtth.exe56⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3bhbbn.exec:\3bhbbn.exe57⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pvdvj.exec:\pvdvj.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrflxfx.exec:\xrflxfx.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llxxllf.exec:\llxxllf.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\thbbtt.exec:\thbbtt.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\btntnb.exec:\btntnb.exe63⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fxxxxlx.exec:\fxxxxlx.exe64⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bhbthb.exec:\bhbthb.exe66⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nhtbnb.exec:\nhtbnb.exe67⤵PID:1932
-
\??\c:\jppjv.exec:\jppjv.exe68⤵PID:1564
-
\??\c:\9flxrfr.exec:\9flxrfr.exe69⤵PID:1668
-
\??\c:\fllrrlf.exec:\fllrrlf.exe70⤵PID:2468
-
\??\c:\tnbbnh.exec:\tnbbnh.exe71⤵PID:2108
-
\??\c:\vdppv.exec:\vdppv.exe72⤵PID:288
-
\??\c:\dpvvd.exec:\dpvvd.exe73⤵PID:896
-
\??\c:\lllxflx.exec:\lllxflx.exe74⤵PID:2400
-
\??\c:\rfrllll.exec:\rfrllll.exe75⤵PID:2248
-
\??\c:\hnbthb.exec:\hnbthb.exe76⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\jjjdv.exec:\jjjdv.exe77⤵PID:1644
-
\??\c:\pvvpd.exec:\pvvpd.exe78⤵PID:2840
-
\??\c:\rlfxlll.exec:\rlfxlll.exe79⤵
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\ffxlfrr.exec:\ffxlfrr.exe80⤵PID:2680
-
\??\c:\hbbhth.exec:\hbbhth.exe81⤵PID:300
-
\??\c:\nbnnbb.exec:\nbnnbb.exe82⤵PID:2796
-
\??\c:\pdvvj.exec:\pdvvj.exe83⤵PID:2348
-
\??\c:\lfflrrf.exec:\lfflrrf.exe84⤵PID:2188
-
\??\c:\xrxfrxl.exec:\xrxfrxl.exe85⤵PID:2040
-
\??\c:\9ntnht.exec:\9ntnht.exe86⤵PID:676
-
\??\c:\hhbtbh.exec:\hhbtbh.exe87⤵PID:1248
-
\??\c:\vvddj.exec:\vvddj.exe88⤵PID:2460
-
\??\c:\dddpv.exec:\dddpv.exe89⤵PID:1992
-
\??\c:\frxxxlr.exec:\frxxxlr.exe90⤵PID:2952
-
\??\c:\xfxfrxr.exec:\xfxfrxr.exe91⤵PID:1356
-
\??\c:\1tbnhb.exec:\1tbnhb.exe92⤵
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\btnntt.exec:\btnntt.exe93⤵PID:2328
-
\??\c:\jjjdv.exec:\jjjdv.exe94⤵PID:2744
-
\??\c:\jjjdv.exec:\jjjdv.exe95⤵PID:3000
-
\??\c:\vvpjj.exec:\vvpjj.exe96⤵PID:1708
-
\??\c:\xxfrfxl.exec:\xxfrfxl.exe97⤵PID:1288
-
\??\c:\3flfxxx.exec:\3flfxxx.exe98⤵PID:2480
-
\??\c:\hnnnbt.exec:\hnnnbt.exe99⤵PID:1464
-
\??\c:\tbbnhn.exec:\tbbnhn.exe100⤵PID:2220
-
\??\c:\vdvpv.exec:\vdvpv.exe101⤵PID:552
-
\??\c:\djpjd.exec:\djpjd.exe102⤵PID:700
-
\??\c:\fllfxrr.exec:\fllfxrr.exe103⤵PID:1448
-
\??\c:\rrffllf.exec:\rrffllf.exe104⤵PID:2456
-
\??\c:\tbhbtn.exec:\tbhbtn.exe105⤵PID:2376
-
\??\c:\httbnn.exec:\httbnn.exe106⤵PID:624
-
\??\c:\pvvjj.exec:\pvvjj.exe107⤵PID:2288
-
\??\c:\5pjjv.exec:\5pjjv.exe108⤵PID:2336
-
\??\c:\rfrrffl.exec:\rfrrffl.exe109⤵PID:3056
-
\??\c:\rrlrxrl.exec:\rrlrxrl.exe110⤵PID:2320
-
\??\c:\7tbnhn.exec:\7tbnhn.exe111⤵PID:992
-
\??\c:\nbhntt.exec:\nbhntt.exe112⤵PID:2408
-
\??\c:\djpvp.exec:\djpvp.exe113⤵PID:1432
-
\??\c:\rfllrrf.exec:\rfllrrf.exe114⤵PID:2468
-
\??\c:\xllxrfx.exec:\xllxrfx.exe115⤵PID:1308
-
\??\c:\nbnhhb.exec:\nbnhhb.exe116⤵PID:2200
-
\??\c:\rllfrfx.exec:\rllfrfx.exe117⤵PID:1484
-
\??\c:\tbtntt.exec:\tbtntt.exe118⤵PID:1720
-
\??\c:\ppvjp.exec:\ppvjp.exe119⤵PID:2420
-
\??\c:\jvjjp.exec:\jvjjp.exe120⤵PID:948
-
\??\c:\flrlfxr.exec:\flrlfxr.exe121⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-