Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe
-
Size
196KB
-
MD5
0098d5aebfa024ab5320c9187b45e091
-
SHA1
2f9d9d79f70a725c58060630d6c508ef589db3a6
-
SHA256
475e3ebe1e56ffdf5408e39607ef343c612470556c780b959a4b909da60421ea
-
SHA512
e928cdbae0b85e89ece23024b9e97d80b5b56da4f5e7c865a1f2740b364e41a678103bf365781a4881331c49681d05e2687cacbaee3c5fca50a928dd7e59368f
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqy1ce7q:PhOm2sI93UufdC67cih/u
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral2/memory/1808-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-691-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-663-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-554-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-544-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4120 rrlfxxf.exe 4844 nhtttb.exe 1808 jdjjd.exe 3336 1rflxff.exe 3056 bnhttt.exe 2888 vvjvd.exe 464 xxxfffl.exe 4836 ntnbtn.exe 2640 pjvjv.exe 1640 5frfxlx.exe 3160 tbbnbn.exe 4408 thnntb.exe 3236 jjdjd.exe 4372 rllllff.exe 2704 bnnnbn.exe 1888 jvpjd.exe 1168 flrrrrx.exe 3076 nbbbnh.exe 3764 jvpjd.exe 1148 rfrrfxf.exe 1632 thhhbt.exe 3152 lfllrxr.exe 4428 nbttbn.exe 1476 vvjpp.exe 3188 rrxxlrl.exe 4964 rxfxxxx.exe 1828 tbbntt.exe 3616 ddddv.exe 4504 pjjdv.exe 4076 lxxrrlf.exe 2292 thtnbb.exe 3100 jppvv.exe 2296 rxxrrrf.exe 1752 xfxlffr.exe 4432 nbhbbt.exe 3372 vvpjv.exe 4168 1djjv.exe 4120 rrllrrr.exe 2892 tbbbhh.exe 3176 vjdjd.exe 2052 frlfxrl.exe 1356 xlrlrrf.exe 4388 hhhbtt.exe 3368 vpvjj.exe 4788 rflllxf.exe 2372 nnbhnt.exe 1524 hbtntt.exe 1592 5jppj.exe 2884 rlrxxff.exe 1408 xrlfxxr.exe 4312 thhttb.exe 4304 9ntnnn.exe 1788 vjjpj.exe 4316 lrxxlxl.exe 4372 rlfllll.exe 4916 9hbbhn.exe 4464 pjvpd.exe 1164 jpvvp.exe 4580 lrlffll.exe 1272 9bhhnn.exe 3168 tttbtb.exe 3020 vjpjj.exe 3804 dvddj.exe 3660 rrrfxrl.exe -
resource yara_rule behavioral2/memory/4120-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-486-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-498-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-533-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-600-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-670-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-698-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-706-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-702-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-716-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-753-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-769-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-691-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-785-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-795-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-663-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-632-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-622-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-593-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-554-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-544-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-537-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-367-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 4120 4700 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 86 PID 4700 wrote to memory of 4120 4700 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 86 PID 4700 wrote to memory of 4120 4700 0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe 86 PID 4120 wrote to memory of 4844 4120 rrlfxxf.exe 87 PID 4120 wrote to memory of 4844 4120 rrlfxxf.exe 87 PID 4120 wrote to memory of 4844 4120 rrlfxxf.exe 87 PID 4844 wrote to memory of 1808 4844 nhtttb.exe 88 PID 4844 wrote to memory of 1808 4844 nhtttb.exe 88 PID 4844 wrote to memory of 1808 4844 nhtttb.exe 88 PID 1808 wrote to memory of 3336 1808 jdjjd.exe 172 PID 1808 wrote to memory of 3336 1808 jdjjd.exe 172 PID 1808 wrote to memory of 3336 1808 jdjjd.exe 172 PID 3336 wrote to memory of 3056 3336 1rflxff.exe 90 PID 3336 wrote to memory of 3056 3336 1rflxff.exe 90 PID 3336 wrote to memory of 3056 3336 1rflxff.exe 90 PID 3056 wrote to memory of 2888 3056 bnhttt.exe 91 PID 3056 wrote to memory of 2888 3056 bnhttt.exe 91 PID 3056 wrote to memory of 2888 3056 bnhttt.exe 91 PID 2888 wrote to memory of 464 2888 vvjvd.exe 92 PID 2888 wrote to memory of 464 2888 vvjvd.exe 92 PID 2888 wrote to memory of 464 2888 vvjvd.exe 92 PID 464 wrote to memory of 4836 464 xxxfffl.exe 93 PID 464 wrote to memory of 4836 464 xxxfffl.exe 93 PID 464 wrote to memory of 4836 464 xxxfffl.exe 93 PID 4836 wrote to memory of 2640 4836 ntnbtn.exe 94 PID 4836 wrote to memory of 2640 4836 ntnbtn.exe 94 PID 4836 wrote to memory of 2640 4836 ntnbtn.exe 94 PID 2640 wrote to memory of 1640 2640 pjvjv.exe 95 PID 2640 wrote to memory of 1640 2640 pjvjv.exe 95 PID 2640 wrote to memory of 1640 2640 pjvjv.exe 95 PID 1640 wrote to memory of 3160 1640 5frfxlx.exe 96 PID 1640 wrote to memory of 3160 1640 5frfxlx.exe 96 PID 1640 wrote to memory of 3160 1640 5frfxlx.exe 96 PID 3160 wrote to memory of 4408 3160 tbbnbn.exe 98 PID 3160 wrote to memory of 4408 3160 tbbnbn.exe 98 PID 3160 wrote to memory of 4408 3160 tbbnbn.exe 98 PID 4408 wrote to memory of 3236 4408 thnntb.exe 99 PID 4408 wrote to memory of 3236 4408 thnntb.exe 99 PID 4408 wrote to memory of 3236 4408 thnntb.exe 99 PID 3236 wrote to memory of 4372 3236 jjdjd.exe 100 PID 3236 wrote to memory of 4372 3236 jjdjd.exe 100 PID 3236 wrote to memory of 4372 3236 jjdjd.exe 100 PID 4372 wrote to memory of 2704 4372 rllllff.exe 101 PID 4372 wrote to memory of 2704 4372 rllllff.exe 101 PID 4372 wrote to memory of 2704 4372 rllllff.exe 101 PID 2704 wrote to memory of 1888 2704 bnnnbn.exe 102 PID 2704 wrote to memory of 1888 2704 bnnnbn.exe 102 PID 2704 wrote to memory of 1888 2704 bnnnbn.exe 102 PID 1888 wrote to memory of 1168 1888 jvpjd.exe 103 PID 1888 wrote to memory of 1168 1888 jvpjd.exe 103 PID 1888 wrote to memory of 1168 1888 jvpjd.exe 103 PID 1168 wrote to memory of 3076 1168 flrrrrx.exe 104 PID 1168 wrote to memory of 3076 1168 flrrrrx.exe 104 PID 1168 wrote to memory of 3076 1168 flrrrrx.exe 104 PID 3076 wrote to memory of 3764 3076 nbbbnh.exe 192 PID 3076 wrote to memory of 3764 3076 nbbbnh.exe 192 PID 3076 wrote to memory of 3764 3076 nbbbnh.exe 192 PID 3764 wrote to memory of 1148 3764 jvpjd.exe 238 PID 3764 wrote to memory of 1148 3764 jvpjd.exe 238 PID 3764 wrote to memory of 1148 3764 jvpjd.exe 238 PID 1148 wrote to memory of 1632 1148 rfrrfxf.exe 107 PID 1148 wrote to memory of 1632 1148 rfrrfxf.exe 107 PID 1148 wrote to memory of 1632 1148 rfrrfxf.exe 107 PID 1632 wrote to memory of 3152 1632 thhhbt.exe 151
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0098d5aebfa024ab5320c9187b45e091_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\nhtttb.exec:\nhtttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\jdjjd.exec:\jdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\1rflxff.exec:\1rflxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\bnhttt.exec:\bnhttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vvjvd.exec:\vvjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xxxfffl.exec:\xxxfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\ntnbtn.exec:\ntnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\pjvjv.exec:\pjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5frfxlx.exec:\5frfxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\tbbnbn.exec:\tbbnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\thnntb.exec:\thnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\jjdjd.exec:\jjdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\rllllff.exec:\rllllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\bnnnbn.exec:\bnnnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jvpjd.exec:\jvpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\flrrrrx.exec:\flrrrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\nbbbnh.exec:\nbbbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\jvpjd.exec:\jvpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\rfrrfxf.exec:\rfrrfxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\thhhbt.exec:\thhhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\lfllrxr.exec:\lfllrxr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152 -
\??\c:\nbttbn.exec:\nbttbn.exe24⤵
- Executes dropped EXE
PID:4428 -
\??\c:\vvjpp.exec:\vvjpp.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe26⤵
- Executes dropped EXE
PID:3188 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe27⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tbbntt.exec:\tbbntt.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pjjdv.exec:\pjjdv.exe30⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe31⤵
- Executes dropped EXE
PID:4076 -
\??\c:\thtnbb.exec:\thtnbb.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jppvv.exec:\jppvv.exe33⤵
- Executes dropped EXE
PID:3100 -
\??\c:\rxxrrrf.exec:\rxxrrrf.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xfxlffr.exec:\xfxlffr.exe35⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nbhbbt.exec:\nbhbbt.exe36⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvpjv.exec:\vvpjv.exe37⤵
- Executes dropped EXE
PID:3372 -
\??\c:\1djjv.exec:\1djjv.exe38⤵
- Executes dropped EXE
PID:4168 -
\??\c:\rrllrrr.exec:\rrllrrr.exe39⤵
- Executes dropped EXE
PID:4120 -
\??\c:\tbbbhh.exec:\tbbbhh.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjdjd.exec:\vjdjd.exe41⤵
- Executes dropped EXE
PID:3176 -
\??\c:\frlfxrl.exec:\frlfxrl.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xlrlrrf.exec:\xlrlrrf.exe43⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hhhbtt.exec:\hhhbtt.exe44⤵
- Executes dropped EXE
PID:4388 -
\??\c:\vpvjj.exec:\vpvjj.exe45⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rflllxf.exec:\rflllxf.exe46⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nnbhnt.exec:\nnbhnt.exe47⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hbtntt.exec:\hbtntt.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5jppj.exec:\5jppj.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rlrxxff.exec:\rlrxxff.exe50⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe51⤵
- Executes dropped EXE
PID:1408 -
\??\c:\thhttb.exec:\thhttb.exe52⤵
- Executes dropped EXE
PID:4312 -
\??\c:\9ntnnn.exec:\9ntnnn.exe53⤵
- Executes dropped EXE
PID:4304 -
\??\c:\vjjpj.exec:\vjjpj.exe54⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lrxxlxl.exec:\lrxxlxl.exe55⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rlfllll.exec:\rlfllll.exe56⤵
- Executes dropped EXE
PID:4372 -
\??\c:\9hbbhn.exec:\9hbbhn.exe57⤵
- Executes dropped EXE
PID:4916 -
\??\c:\pjvpd.exec:\pjvpd.exe58⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jpvvp.exec:\jpvvp.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\lrlffll.exec:\lrlffll.exe60⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9bhhnn.exec:\9bhhnn.exe61⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tttbtb.exec:\tttbtb.exe62⤵
- Executes dropped EXE
PID:3168 -
\??\c:\vjpjj.exec:\vjpjj.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvddj.exec:\dvddj.exe64⤵
- Executes dropped EXE
PID:3804 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe65⤵
- Executes dropped EXE
PID:3660 -
\??\c:\frlrlxr.exec:\frlrlxr.exe66⤵PID:3152
-
\??\c:\nnhhtb.exec:\nnhhtb.exe67⤵PID:4428
-
\??\c:\bbhhhn.exec:\bbhhhn.exe68⤵PID:1476
-
\??\c:\7vppp.exec:\7vppp.exe69⤵PID:3188
-
\??\c:\fxllxxf.exec:\fxllxxf.exe70⤵PID:3264
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe71⤵PID:2088
-
\??\c:\hbhhbb.exec:\hbhhbb.exe72⤵PID:1828
-
\??\c:\nnhhhh.exec:\nnhhhh.exe73⤵PID:5048
-
\??\c:\7vppj.exec:\7vppj.exe74⤵PID:3848
-
\??\c:\jvppv.exec:\jvppv.exe75⤵PID:3616
-
\??\c:\rflllfx.exec:\rflllfx.exe76⤵PID:4504
-
\??\c:\rxrxxff.exec:\rxrxxff.exe77⤵PID:4076
-
\??\c:\tbntnh.exec:\tbntnh.exe78⤵PID:1988
-
\??\c:\hhnnbh.exec:\hhnnbh.exe79⤵PID:3028
-
\??\c:\dvjjj.exec:\dvjjj.exe80⤵PID:2296
-
\??\c:\flfxlfr.exec:\flfxlfr.exe81⤵
- System Location Discovery: System Language Discovery
PID:4576 -
\??\c:\xxrlllf.exec:\xxrlllf.exe82⤵PID:4432
-
\??\c:\hhtnnt.exec:\hhtnnt.exe83⤵PID:3372
-
\??\c:\btnhtt.exec:\btnhtt.exe84⤵PID:4168
-
\??\c:\ppdjv.exec:\ppdjv.exe85⤵PID:4120
-
\??\c:\ppvdd.exec:\ppvdd.exe86⤵PID:2772
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe87⤵
- System Location Discovery: System Language Discovery
PID:3336 -
\??\c:\7ffllrx.exec:\7ffllrx.exe88⤵PID:3056
-
\??\c:\ttbbbn.exec:\ttbbbn.exe89⤵PID:3700
-
\??\c:\bbbbbh.exec:\bbbbbh.exe90⤵PID:4388
-
\??\c:\1jvvd.exec:\1jvvd.exe91⤵PID:1316
-
\??\c:\dvvpp.exec:\dvvpp.exe92⤵PID:4788
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe93⤵PID:2584
-
\??\c:\lxfxrxx.exec:\lxfxrxx.exe94⤵PID:3796
-
\??\c:\ttbtnb.exec:\ttbtnb.exe95⤵PID:3084
-
\??\c:\pjjdp.exec:\pjjdp.exe96⤵PID:4128
-
\??\c:\ddvdp.exec:\ddvdp.exe97⤵PID:3820
-
\??\c:\lflrlxr.exec:\lflrlxr.exe98⤵PID:4600
-
\??\c:\hntnhh.exec:\hntnhh.exe99⤵PID:4456
-
\??\c:\hhhtnt.exec:\hhhtnt.exe100⤵PID:3236
-
\??\c:\pdppv.exec:\pdppv.exe101⤵PID:4024
-
\??\c:\vvddv.exec:\vvddv.exe102⤵PID:4372
-
\??\c:\xflffxx.exec:\xflffxx.exe103⤵PID:2544
-
\??\c:\5frrxfr.exec:\5frrxfr.exe104⤵PID:2984
-
\??\c:\httnbt.exec:\httnbt.exe105⤵PID:1164
-
\??\c:\nbhhhn.exec:\nbhhhn.exe106⤵PID:3232
-
\??\c:\vpjdj.exec:\vpjdj.exe107⤵PID:3764
-
\??\c:\pjpdj.exec:\pjpdj.exe108⤵PID:3168
-
\??\c:\fffffrx.exec:\fffffrx.exe109⤵PID:432
-
\??\c:\bthhtt.exec:\bthhtt.exe110⤵PID:2060
-
\??\c:\ttbbbt.exec:\ttbbbt.exe111⤵
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\dvddd.exec:\dvddd.exe112⤵PID:3960
-
\??\c:\9ppjd.exec:\9ppjd.exe113⤵PID:4428
-
\??\c:\lrfrrrl.exec:\lrfrrrl.exe114⤵PID:5068
-
\??\c:\rlxrxlx.exec:\rlxrxlx.exe115⤵PID:3200
-
\??\c:\bnttbh.exec:\bnttbh.exe116⤵PID:2472
-
\??\c:\3tnntt.exec:\3tnntt.exe117⤵PID:512
-
\??\c:\ppdpp.exec:\ppdpp.exe118⤵PID:4584
-
\??\c:\jdjjd.exec:\jdjjd.exe119⤵PID:5024
-
\??\c:\rxrrrxf.exec:\rxrrrxf.exe120⤵PID:2980
-
\??\c:\frxllll.exec:\frxllll.exe121⤵PID:4016
-
\??\c:\hnnhtn.exec:\hnnhtn.exe122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-