Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 00:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0400434332731d9eb14c563f4288e399_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0400434332731d9eb14c563f4288e399_JaffaCakes118.exe
-
Size
189KB
-
MD5
0400434332731d9eb14c563f4288e399
-
SHA1
106403e076374d84dc3755e1d111f6b7cd93a3fd
-
SHA256
95bda3688357336465a824f8427407ab89ba98a2d2f3b3c345ef906ddde26c53
-
SHA512
68e90b5d253d2d6fdc73ba35b3bec98d2d7eb82f57c4f55586fc5b44bc3eb42d2be6dc74fb5cbd668683ad3e6d72af53fade4756d68bd68a8061c5ccabd76722
-
SSDEEP
1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYoOrk4J:EhOm2sI93UufdC67ciyt3ujFf7oOrZ
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2456-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-251-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-1202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-1090-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-986-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 1lrffrl.exe 2456 bbnthh.exe 872 dvdpj.exe 2372 jvvvd.exe 2592 lffrfrf.exe 2628 ntbbbn.exe 2768 ddpvv.exe 2704 7lxffxl.exe 2780 ntbhhh.exe 2336 nntnbb.exe 2504 djdpd.exe 2420 xffrlrr.exe 2968 ttbhbh.exe 2028 nttnhh.exe 2256 pdjdp.exe 1444 rrxlfrr.exe 1656 lxfxfxx.exe 760 bhnbbh.exe 1884 vvjjp.exe 1116 vvdvj.exe 2540 ffxlxrf.exe 2464 rxfrlrl.exe 2348 pvdjv.exe 1580 vjjvv.exe 2376 frxlrll.exe 1296 ttthbn.exe 768 rrxrxfl.exe 1876 rlxfllx.exe 1680 tbhhhb.exe 2132 vvdjd.exe 2916 9jdjj.exe 1512 7rllrxl.exe 1408 hhnhnb.exe 2100 1vpjj.exe 2120 pjpdd.exe 1492 frrfxfx.exe 2732 ntbbhh.exe 2604 jdvdj.exe 1908 djvdd.exe 2672 5xxfffr.exe 2332 rxlfflf.exe 2556 1btbnt.exe 2336 tntttt.exe 2496 pdvvd.exe 2312 ffrfxfx.exe 2624 tbthhn.exe 848 bnbttn.exe 1004 ddpvv.exe 2256 ddjdd.exe 2476 xxxrflf.exe 1236 9rlrffr.exe 1972 tbthth.exe 2668 nttnbt.exe 2804 dddpp.exe 3068 9xrrfxx.exe 1600 xxrfrxl.exe 1604 tnbhhn.exe 2680 9hthtb.exe 2900 9vvjj.exe 2600 vjvpd.exe 2820 lrlfrlf.exe 1300 1fxxllx.exe 316 1nntth.exe 2432 djdjv.exe -
resource yara_rule behavioral1/memory/2456-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-1297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-1365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-1283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-1258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-1239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-986-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-144-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 2996 1568 0400434332731d9eb14c563f4288e399_JaffaCakes118.exe 30 PID 1568 wrote to memory of 2996 1568 0400434332731d9eb14c563f4288e399_JaffaCakes118.exe 30 PID 1568 wrote to memory of 2996 1568 0400434332731d9eb14c563f4288e399_JaffaCakes118.exe 30 PID 1568 wrote to memory of 2996 1568 0400434332731d9eb14c563f4288e399_JaffaCakes118.exe 30 PID 2996 wrote to memory of 2456 2996 1lrffrl.exe 31 PID 2996 wrote to memory of 2456 2996 1lrffrl.exe 31 PID 2996 wrote to memory of 2456 2996 1lrffrl.exe 31 PID 2996 wrote to memory of 2456 2996 1lrffrl.exe 31 PID 2456 wrote to memory of 872 2456 bbnthh.exe 32 PID 2456 wrote to memory of 872 2456 bbnthh.exe 32 PID 2456 wrote to memory of 872 2456 bbnthh.exe 32 PID 2456 wrote to memory of 872 2456 bbnthh.exe 32 PID 872 wrote to memory of 2372 872 dvdpj.exe 33 PID 872 wrote to memory of 2372 872 dvdpj.exe 33 PID 872 wrote to memory of 2372 872 dvdpj.exe 33 PID 872 wrote to memory of 2372 872 dvdpj.exe 33 PID 2372 wrote to memory of 2592 2372 jvvvd.exe 34 PID 2372 wrote to memory of 2592 2372 jvvvd.exe 34 PID 2372 wrote to memory of 2592 2372 jvvvd.exe 34 PID 2372 wrote to memory of 2592 2372 jvvvd.exe 34 PID 2592 wrote to memory of 2628 2592 lffrfrf.exe 35 PID 2592 wrote to memory of 2628 2592 lffrfrf.exe 35 PID 2592 wrote to memory of 2628 2592 lffrfrf.exe 35 PID 2592 wrote to memory of 2628 2592 lffrfrf.exe 35 PID 2628 wrote to memory of 2768 2628 ntbbbn.exe 36 PID 2628 wrote to memory of 2768 2628 ntbbbn.exe 36 PID 2628 wrote to memory of 2768 2628 ntbbbn.exe 36 PID 2628 wrote to memory of 2768 2628 ntbbbn.exe 36 PID 2768 wrote to memory of 2704 2768 ddpvv.exe 37 PID 2768 wrote to memory of 2704 2768 ddpvv.exe 37 PID 2768 wrote to memory of 2704 2768 ddpvv.exe 37 PID 2768 wrote to memory of 2704 2768 ddpvv.exe 37 PID 2704 wrote to memory of 2780 2704 7lxffxl.exe 38 PID 2704 wrote to memory of 2780 2704 7lxffxl.exe 38 PID 2704 wrote to memory of 2780 2704 7lxffxl.exe 38 PID 2704 wrote to memory of 2780 2704 7lxffxl.exe 38 PID 2780 wrote to memory of 2336 2780 ntbhhh.exe 72 PID 2780 wrote to memory of 2336 2780 ntbhhh.exe 72 PID 2780 wrote to memory of 2336 2780 ntbhhh.exe 72 PID 2780 wrote to memory of 2336 2780 ntbhhh.exe 72 PID 2336 wrote to memory of 2504 2336 nntnbb.exe 40 PID 2336 wrote to memory of 2504 2336 nntnbb.exe 40 PID 2336 wrote to memory of 2504 2336 nntnbb.exe 40 PID 2336 wrote to memory of 2504 2336 nntnbb.exe 40 PID 2504 wrote to memory of 2420 2504 djdpd.exe 41 PID 2504 wrote to memory of 2420 2504 djdpd.exe 41 PID 2504 wrote to memory of 2420 2504 djdpd.exe 41 PID 2504 wrote to memory of 2420 2504 djdpd.exe 41 PID 2420 wrote to memory of 2968 2420 xffrlrr.exe 42 PID 2420 wrote to memory of 2968 2420 xffrlrr.exe 42 PID 2420 wrote to memory of 2968 2420 xffrlrr.exe 42 PID 2420 wrote to memory of 2968 2420 xffrlrr.exe 42 PID 2968 wrote to memory of 2028 2968 ttbhbh.exe 43 PID 2968 wrote to memory of 2028 2968 ttbhbh.exe 43 PID 2968 wrote to memory of 2028 2968 ttbhbh.exe 43 PID 2968 wrote to memory of 2028 2968 ttbhbh.exe 43 PID 2028 wrote to memory of 2256 2028 nttnhh.exe 44 PID 2028 wrote to memory of 2256 2028 nttnhh.exe 44 PID 2028 wrote to memory of 2256 2028 nttnhh.exe 44 PID 2028 wrote to memory of 2256 2028 nttnhh.exe 44 PID 2256 wrote to memory of 1444 2256 pdjdp.exe 45 PID 2256 wrote to memory of 1444 2256 pdjdp.exe 45 PID 2256 wrote to memory of 1444 2256 pdjdp.exe 45 PID 2256 wrote to memory of 1444 2256 pdjdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0400434332731d9eb14c563f4288e399_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0400434332731d9eb14c563f4288e399_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\1lrffrl.exec:\1lrffrl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bbnthh.exec:\bbnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dvdpj.exec:\dvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\jvvvd.exec:\jvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lffrfrf.exec:\lffrfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ntbbbn.exec:\ntbbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ddpvv.exec:\ddpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7lxffxl.exec:\7lxffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ntbhhh.exec:\ntbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nntnbb.exec:\nntnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\djdpd.exec:\djdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xffrlrr.exec:\xffrlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ttbhbh.exec:\ttbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nttnhh.exec:\nttnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\pdjdp.exec:\pdjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rrxlfrr.exec:\rrxlfrr.exe17⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxfxfxx.exec:\lxfxfxx.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bhnbbh.exec:\bhnbbh.exe19⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvjjp.exec:\vvjjp.exe20⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vvdvj.exec:\vvdvj.exe21⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ffxlxrf.exec:\ffxlxrf.exe22⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvdjv.exec:\pvdjv.exe24⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjjvv.exec:\vjjvv.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\frxlrll.exec:\frxlrll.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ttthbn.exec:\ttthbn.exe27⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rrxrxfl.exec:\rrxrxfl.exe28⤵
- Executes dropped EXE
PID:768 -
\??\c:\rlxfllx.exec:\rlxfllx.exe29⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tbhhhb.exec:\tbhhhb.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vvdjd.exec:\vvdjd.exe31⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9jdjj.exec:\9jdjj.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7rllrxl.exec:\7rllrxl.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhnhnb.exec:\hhnhnb.exe34⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1vpjj.exec:\1vpjj.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjpdd.exec:\pjpdd.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\frrfxfx.exec:\frrfxfx.exe37⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ntbbhh.exec:\ntbbhh.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvdj.exec:\jdvdj.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\djvdd.exec:\djvdd.exe40⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5xxfffr.exec:\5xxfffr.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rxlfflf.exec:\rxlfflf.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1btbnt.exec:\1btbnt.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tntttt.exec:\tntttt.exe44⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pdvvd.exec:\pdvvd.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe46⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tbthhn.exec:\tbthhn.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bnbttn.exec:\bnbttn.exe48⤵
- Executes dropped EXE
PID:848 -
\??\c:\ddpvv.exec:\ddpvv.exe49⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ddjdd.exec:\ddjdd.exe50⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xxxrflf.exec:\xxxrflf.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9rlrffr.exec:\9rlrffr.exe52⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tbthth.exec:\tbthth.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nttnbt.exec:\nttnbt.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dddpp.exec:\dddpp.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9xrrfxx.exec:\9xrrfxx.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnbhhn.exec:\tnbhhn.exe58⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9hthtb.exec:\9hthtb.exe59⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9vvjj.exec:\9vvjj.exe60⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vjvpd.exec:\vjvpd.exe61⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe62⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1fxxllx.exec:\1fxxllx.exe63⤵
- Executes dropped EXE
PID:1300 -
\??\c:\1nntth.exec:\1nntth.exe64⤵
- Executes dropped EXE
PID:316 -
\??\c:\djdjv.exec:\djdjv.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\7dpvj.exec:\7dpvj.exe66⤵PID:2252
-
\??\c:\7xxlrxr.exec:\7xxlrxr.exe67⤵PID:2436
-
\??\c:\xfxfxfl.exec:\xfxfxfl.exe68⤵PID:3012
-
\??\c:\nnnbth.exec:\nnnbth.exe69⤵PID:2080
-
\??\c:\hbnbbb.exec:\hbnbbb.exe70⤵PID:1596
-
\??\c:\bbtbnt.exec:\bbtbnt.exe71⤵PID:2040
-
\??\c:\jdppv.exec:\jdppv.exe72⤵PID:1424
-
\??\c:\pjvvj.exec:\pjvvj.exe73⤵PID:1592
-
\??\c:\llfxfrr.exec:\llfxfrr.exe74⤵PID:2640
-
\??\c:\frxrffl.exec:\frxrffl.exe75⤵
- System Location Discovery: System Language Discovery
PID:308 -
\??\c:\hnnhbh.exec:\hnnhbh.exe76⤵PID:2732
-
\??\c:\9tbtbn.exec:\9tbtbn.exe77⤵PID:2604
-
\??\c:\jjdvd.exec:\jjdvd.exe78⤵PID:1908
-
\??\c:\pdvvp.exec:\pdvvp.exe79⤵PID:1612
-
\??\c:\llflxlx.exec:\llflxlx.exe80⤵PID:2780
-
\??\c:\flrrrrr.exec:\flrrrrr.exe81⤵PID:2500
-
\??\c:\nbbbhb.exec:\nbbbhb.exe82⤵PID:1712
-
\??\c:\bnnbhb.exec:\bnnbhb.exe83⤵PID:1568
-
\??\c:\djdjj.exec:\djdjj.exe84⤵PID:2496
-
\??\c:\ppdvj.exec:\ppdvj.exe85⤵PID:2312
-
\??\c:\5fflflx.exec:\5fflflx.exe86⤵PID:1728
-
\??\c:\xxrlffr.exec:\xxrlffr.exe87⤵PID:540
-
\??\c:\1thbbt.exec:\1thbbt.exe88⤵
- System Location Discovery: System Language Discovery
PID:1860 -
\??\c:\9hhnth.exec:\9hhnth.exe89⤵PID:1384
-
\??\c:\vppvj.exec:\vppvj.exe90⤵PID:1240
-
\??\c:\ppjvv.exec:\ppjvv.exe91⤵PID:1960
-
\??\c:\lfxflxl.exec:\lfxflxl.exe92⤵PID:2284
-
\??\c:\1lxfxlx.exec:\1lxfxlx.exe93⤵PID:2136
-
\??\c:\hhnthh.exec:\hhnthh.exe94⤵PID:1800
-
\??\c:\bbthbb.exec:\bbthbb.exe95⤵PID:1136
-
\??\c:\9vvvj.exec:\9vvvj.exe96⤵PID:2800
-
\??\c:\ppppd.exec:\ppppd.exe97⤵PID:2176
-
\??\c:\llffxlx.exec:\llffxlx.exe98⤵PID:2564
-
\??\c:\ffrfxlf.exec:\ffrfxlf.exe99⤵
- System Location Discovery: System Language Discovery
PID:344 -
\??\c:\rrxfrff.exec:\rrxfrff.exe100⤵PID:1664
-
\??\c:\5nnthn.exec:\5nnthn.exe101⤵PID:2076
-
\??\c:\tnbthn.exec:\tnbthn.exe102⤵PID:1312
-
\??\c:\djjpd.exec:\djjpd.exe103⤵PID:792
-
\??\c:\jjpvv.exec:\jjpvv.exe104⤵PID:1268
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe105⤵PID:2144
-
\??\c:\xrlrllx.exec:\xrlrllx.exe106⤵PID:1984
-
\??\c:\ttbnnh.exec:\ttbnnh.exe107⤵PID:948
-
\??\c:\tnhhnn.exec:\tnhhnn.exe108⤵PID:3052
-
\??\c:\3jjpd.exec:\3jjpd.exe109⤵PID:2172
-
\??\c:\dvvjd.exec:\dvvjd.exe110⤵PID:1948
-
\??\c:\5llfflf.exec:\5llfflf.exe111⤵PID:2456
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe112⤵PID:896
-
\??\c:\bbtbbt.exec:\bbtbbt.exe113⤵PID:2100
-
\??\c:\7djdv.exec:\7djdv.exe114⤵PID:2648
-
\??\c:\pjpvd.exec:\pjpvd.exe115⤵PID:2656
-
\??\c:\rrllrrx.exec:\rrllrrx.exe116⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\lrflffx.exec:\lrflffx.exe117⤵PID:2724
-
\??\c:\btthbn.exec:\btthbn.exe118⤵PID:2536
-
\??\c:\7hbthb.exec:\7hbthb.exe119⤵PID:2856
-
\??\c:\jjjvv.exec:\jjjvv.exe120⤵PID:2512
-
\??\c:\vvvpj.exec:\vvvpj.exe121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-