Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240729-en -
resource tags
arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 00:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe
-
Size
460KB
-
MD5
036ec09cb290b832438fe3cc04661c86
-
SHA1
33f9c99059c36db0f584d51cf70ad7b0dce747b2
-
SHA256
9deb65f64e3e481e6878581c617e129700548364b485a777b85df5e738a21bdf
-
SHA512
d826b1006fbf136ecb205a9da4382f1938f94d87a2f61770638a525bffb4e60111b0494a113f96b357ceef378bcdc2288f954f917a4df71231ba615baf8da70c
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HsstsQ:d7Tc9Wj16A3StvxEQ
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4884-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-587-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-625-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-644-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-594-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-566-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-558-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1196 5thnhn.exe 4616 nhnnbb.exe 4844 jpvvv.exe 2376 hhtttb.exe 1628 vjppj.exe 2620 dvppd.exe 4928 frfflrr.exe 3796 hnnnbb.exe 4140 ddjvv.exe 5112 frllrxr.exe 1728 thnhhn.exe 1952 bntttb.exe 3820 hhhnnt.exe 2244 5rrllrl.exe 1644 nhbbbh.exe 1148 jvppp.exe 3852 fflfxfx.exe 1300 hhtttb.exe 4276 1jddv.exe 4516 fxrffll.exe 4600 5bbbtb.exe 1684 djjpp.exe 220 xrlffff.exe 3064 vdddj.exe 5080 xrlfxrl.exe 1596 jjpvv.exe 3768 xfffllf.exe 5044 7hhhhh.exe 1828 ddppd.exe 2540 lfxxxlr.exe 1912 hntnnn.exe 2976 vvjjj.exe 4192 ttnbhh.exe 3824 ddddd.exe 2552 fxffxff.exe 2400 nhhhnt.exe 1188 lxllrrr.exe 4640 hhhhhn.exe 3916 pvvjv.exe 3872 xlxfrfx.exe 3772 1llfxxf.exe 4968 btthbn.exe 4228 5rlfxrl.exe 2480 nhhbtt.exe 1404 ppvpp.exe 4836 pjpjp.exe 4004 rlrrrrr.exe 2052 jppvd.exe 1068 lxxrrxr.exe 3132 btthhb.exe 2604 pppdv.exe 4452 rlffrlx.exe 3560 bntnhn.exe 3192 vjpjj.exe 1724 rflxxrx.exe 2096 xrfxrlf.exe 1732 tbtthn.exe 3756 vdjdd.exe 1944 rlffffr.exe 4568 hbtbtb.exe 1572 jjjjj.exe 4524 dpvpp.exe 3296 lfffrxr.exe 3124 7bhtnt.exe -
resource yara_rule behavioral2/memory/4884-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-520-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-587-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-611-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-625-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-654-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-644-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-621-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-607-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-566-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-562-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-551-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-528-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-524-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1196 4884 036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe 84 PID 4884 wrote to memory of 1196 4884 036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe 84 PID 4884 wrote to memory of 1196 4884 036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe 84 PID 1196 wrote to memory of 4616 1196 5thnhn.exe 86 PID 1196 wrote to memory of 4616 1196 5thnhn.exe 86 PID 1196 wrote to memory of 4616 1196 5thnhn.exe 86 PID 4616 wrote to memory of 4844 4616 nhnnbb.exe 302 PID 4616 wrote to memory of 4844 4616 nhnnbb.exe 302 PID 4616 wrote to memory of 4844 4616 nhnnbb.exe 302 PID 4844 wrote to memory of 2376 4844 jpvvv.exe 89 PID 4844 wrote to memory of 2376 4844 jpvvv.exe 89 PID 4844 wrote to memory of 2376 4844 jpvvv.exe 89 PID 2376 wrote to memory of 1628 2376 hhtttb.exe 246 PID 2376 wrote to memory of 1628 2376 hhtttb.exe 246 PID 2376 wrote to memory of 1628 2376 hhtttb.exe 246 PID 1628 wrote to memory of 2620 1628 vjppj.exe 91 PID 1628 wrote to memory of 2620 1628 vjppj.exe 91 PID 1628 wrote to memory of 2620 1628 vjppj.exe 91 PID 2620 wrote to memory of 4928 2620 dvppd.exe 92 PID 2620 wrote to memory of 4928 2620 dvppd.exe 92 PID 2620 wrote to memory of 4928 2620 dvppd.exe 92 PID 4928 wrote to memory of 3796 4928 frfflrr.exe 93 PID 4928 wrote to memory of 3796 4928 frfflrr.exe 93 PID 4928 wrote to memory of 3796 4928 frfflrr.exe 93 PID 3796 wrote to memory of 4140 3796 hnnnbb.exe 94 PID 3796 wrote to memory of 4140 3796 hnnnbb.exe 94 PID 3796 wrote to memory of 4140 3796 hnnnbb.exe 94 PID 4140 wrote to memory of 5112 4140 ddjvv.exe 194 PID 4140 wrote to memory of 5112 4140 ddjvv.exe 194 PID 4140 wrote to memory of 5112 4140 ddjvv.exe 194 PID 5112 wrote to memory of 1728 5112 frllrxr.exe 96 PID 5112 wrote to memory of 1728 5112 frllrxr.exe 96 PID 5112 wrote to memory of 1728 5112 frllrxr.exe 96 PID 1728 wrote to memory of 1952 1728 thnhhn.exe 199 PID 1728 wrote to memory of 1952 1728 thnhhn.exe 199 PID 1728 wrote to memory of 1952 1728 thnhhn.exe 199 PID 1952 wrote to memory of 3820 1952 bntttb.exe 98 PID 1952 wrote to memory of 3820 1952 bntttb.exe 98 PID 1952 wrote to memory of 3820 1952 bntttb.exe 98 PID 3820 wrote to memory of 2244 3820 hhhnnt.exe 99 PID 3820 wrote to memory of 2244 3820 hhhnnt.exe 99 PID 3820 wrote to memory of 2244 3820 hhhnnt.exe 99 PID 2244 wrote to memory of 1644 2244 5rrllrl.exe 100 PID 2244 wrote to memory of 1644 2244 5rrllrl.exe 100 PID 2244 wrote to memory of 1644 2244 5rrllrl.exe 100 PID 1644 wrote to memory of 1148 1644 nhbbbh.exe 101 PID 1644 wrote to memory of 1148 1644 nhbbbh.exe 101 PID 1644 wrote to memory of 1148 1644 nhbbbh.exe 101 PID 1148 wrote to memory of 3852 1148 jvppp.exe 102 PID 1148 wrote to memory of 3852 1148 jvppp.exe 102 PID 1148 wrote to memory of 3852 1148 jvppp.exe 102 PID 3852 wrote to memory of 1300 3852 fflfxfx.exe 103 PID 3852 wrote to memory of 1300 3852 fflfxfx.exe 103 PID 3852 wrote to memory of 1300 3852 fflfxfx.exe 103 PID 1300 wrote to memory of 4276 1300 hhtttb.exe 104 PID 1300 wrote to memory of 4276 1300 hhtttb.exe 104 PID 1300 wrote to memory of 4276 1300 hhtttb.exe 104 PID 4276 wrote to memory of 4516 4276 1jddv.exe 105 PID 4276 wrote to memory of 4516 4276 1jddv.exe 105 PID 4276 wrote to memory of 4516 4276 1jddv.exe 105 PID 4516 wrote to memory of 4600 4516 fxrffll.exe 106 PID 4516 wrote to memory of 4600 4516 fxrffll.exe 106 PID 4516 wrote to memory of 4600 4516 fxrffll.exe 106 PID 4600 wrote to memory of 1684 4600 5bbbtb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\036ec09cb290b832438fe3cc04661c86_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\5thnhn.exec:\5thnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\nhnnbb.exec:\nhnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\jpvvv.exec:\jpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\hhtttb.exec:\hhtttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vjppj.exec:\vjppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dvppd.exec:\dvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\frfflrr.exec:\frfflrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\hnnnbb.exec:\hnnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\ddjvv.exec:\ddjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\frllrxr.exec:\frllrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\thnhhn.exec:\thnhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\bntttb.exec:\bntttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\hhhnnt.exec:\hhhnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\5rrllrl.exec:\5rrllrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\nhbbbh.exec:\nhbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\jvppp.exec:\jvppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\fflfxfx.exec:\fflfxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\hhtttb.exec:\hhtttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\1jddv.exec:\1jddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\fxrffll.exec:\fxrffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\5bbbtb.exec:\5bbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\djjpp.exec:\djjpp.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xrlffff.exec:\xrlffff.exe24⤵
- Executes dropped EXE
PID:220 -
\??\c:\vdddj.exec:\vdddj.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe26⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jjpvv.exec:\jjpvv.exe27⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xfffllf.exec:\xfffllf.exe28⤵
- Executes dropped EXE
PID:3768 -
\??\c:\7hhhhh.exec:\7hhhhh.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\ddppd.exec:\ddppd.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hntnnn.exec:\hntnnn.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vvjjj.exec:\vvjjj.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ttnbhh.exec:\ttnbhh.exe34⤵
- Executes dropped EXE
PID:4192 -
\??\c:\ddddd.exec:\ddddd.exe35⤵
- Executes dropped EXE
PID:3824 -
\??\c:\fxffxff.exec:\fxffxff.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhhhnt.exec:\nhhhnt.exe37⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lxllrrr.exec:\lxllrrr.exe38⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hhhhhn.exec:\hhhhhn.exe39⤵
- Executes dropped EXE
PID:4640 -
\??\c:\pvvjv.exec:\pvvjv.exe40⤵
- Executes dropped EXE
PID:3916 -
\??\c:\xlxfrfx.exec:\xlxfrfx.exe41⤵
- Executes dropped EXE
PID:3872 -
\??\c:\1llfxxf.exec:\1llfxxf.exe42⤵
- Executes dropped EXE
PID:3772 -
\??\c:\btthbn.exec:\btthbn.exe43⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vpjdv.exec:\vpjdv.exe44⤵PID:4240
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe45⤵
- Executes dropped EXE
PID:4228 -
\??\c:\nhhbtt.exec:\nhhbtt.exe46⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ppvpp.exec:\ppvpp.exe47⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pjpjp.exec:\pjpjp.exe48⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\jppvd.exec:\jppvd.exe50⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\btthhb.exec:\btthhb.exe52⤵
- Executes dropped EXE
PID:3132 -
\??\c:\pppdv.exec:\pppdv.exe53⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rlffrlx.exec:\rlffrlx.exe54⤵
- Executes dropped EXE
PID:4452 -
\??\c:\bntnhn.exec:\bntnhn.exe55⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vjpjj.exec:\vjpjj.exe56⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rflxxrx.exec:\rflxxrx.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tbtthn.exec:\tbtthn.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vdjdd.exec:\vdjdd.exe60⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rlffffr.exec:\rlffffr.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbtbtb.exec:\hbtbtb.exe62⤵
- Executes dropped EXE
PID:4568 -
\??\c:\jjjjj.exec:\jjjjj.exe63⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dpvpp.exec:\dpvpp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524 -
\??\c:\lfffrxr.exec:\lfffrxr.exe65⤵
- Executes dropped EXE
PID:3296 -
\??\c:\7bhtnt.exec:\7bhtnt.exe66⤵
- Executes dropped EXE
PID:3124 -
\??\c:\djpjp.exec:\djpjp.exe67⤵
- System Location Discovery: System Language Discovery
PID:3740 -
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:5100
-
\??\c:\9frrrxx.exec:\9frrrxx.exe69⤵PID:3476
-
\??\c:\nnnnhh.exec:\nnnnhh.exe70⤵PID:3340
-
\??\c:\3jvvp.exec:\3jvvp.exe71⤵PID:4384
-
\??\c:\xrfrrff.exec:\xrfrrff.exe72⤵PID:4428
-
\??\c:\nnthth.exec:\nnthth.exe73⤵PID:1436
-
\??\c:\pvdpp.exec:\pvdpp.exe74⤵PID:4584
-
\??\c:\xxffffl.exec:\xxffffl.exe75⤵PID:4396
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe76⤵PID:2492
-
\??\c:\9tnhbb.exec:\9tnhbb.exe77⤵PID:4572
-
\??\c:\rfllllf.exec:\rfllllf.exe78⤵PID:3884
-
\??\c:\rfllffr.exec:\rfllffr.exe79⤵PID:3848
-
\??\c:\hbnnhh.exec:\hbnnhh.exe80⤵PID:5044
-
\??\c:\pvpdp.exec:\pvpdp.exe81⤵PID:4852
-
\??\c:\flrrrxf.exec:\flrrrxf.exe82⤵PID:2240
-
\??\c:\bttnhh.exec:\bttnhh.exe83⤵PID:4596
-
\??\c:\ppvvv.exec:\ppvvv.exe84⤵PID:1476
-
\??\c:\pjvvp.exec:\pjvvp.exe85⤵PID:1600
-
\??\c:\lfllxxx.exec:\lfllxxx.exe86⤵PID:820
-
\??\c:\bbbbtb.exec:\bbbbtb.exe87⤵PID:4080
-
\??\c:\nbhhbt.exec:\nbhhbt.exe88⤵PID:1080
-
\??\c:\vjjvv.exec:\vjjvv.exe89⤵PID:4696
-
\??\c:\lfllrxx.exec:\lfllrxx.exe90⤵PID:1612
-
\??\c:\bhbnhb.exec:\bhbnhb.exe91⤵PID:3876
-
\??\c:\jdddp.exec:\jdddp.exe92⤵PID:1792
-
\??\c:\rrxfflx.exec:\rrxfflx.exe93⤵PID:4592
-
\??\c:\hbhhnt.exec:\hbhhnt.exe94⤵PID:4388
-
\??\c:\bnhbnn.exec:\bnhbnn.exe95⤵PID:1604
-
\??\c:\jdvjj.exec:\jdvjj.exe96⤵PID:4124
-
\??\c:\3fxrfll.exec:\3fxrfll.exe97⤵PID:3208
-
\??\c:\nhhhtn.exec:\nhhhtn.exe98⤵PID:2076
-
\??\c:\htbbbn.exec:\htbbbn.exe99⤵PID:868
-
\??\c:\pvdjv.exec:\pvdjv.exe100⤵PID:2224
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe101⤵PID:392
-
\??\c:\hbnnnt.exec:\hbnnnt.exe102⤵PID:3140
-
\??\c:\thtbbn.exec:\thtbbn.exe103⤵PID:3260
-
\??\c:\9jppp.exec:\9jppp.exe104⤵PID:3132
-
\??\c:\xxrrflf.exec:\xxrrflf.exe105⤵PID:2604
-
\??\c:\1xlllrr.exec:\1xlllrr.exe106⤵PID:2208
-
\??\c:\3nbbbh.exec:\3nbbbh.exe107⤵PID:2696
-
\??\c:\jvvpd.exec:\jvvpd.exe108⤵PID:4368
-
\??\c:\rrrllxx.exec:\rrrllxx.exe109⤵PID:1564
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe110⤵PID:5112
-
\??\c:\bhbbbt.exec:\bhbbbt.exe111⤵PID:4948
-
\??\c:\7pdjj.exec:\7pdjj.exe112⤵PID:3888
-
\??\c:\xflfffx.exec:\xflfffx.exe113⤵PID:1720
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe114⤵PID:748
-
\??\c:\bthbnh.exec:\bthbnh.exe115⤵PID:1952
-
\??\c:\9djdv.exec:\9djdv.exe116⤵PID:1572
-
\??\c:\flrfflr.exec:\flrfflr.exe117⤵PID:536
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe118⤵PID:2056
-
\??\c:\nnnbhb.exec:\nnnbhb.exe119⤵PID:4956
-
\??\c:\ppvvv.exec:\ppvvv.exe120⤵PID:1268
-
\??\c:\1rffrxx.exec:\1rffrxx.exe121⤵PID:3852
-
\??\c:\1rffrxr.exec:\1rffrxr.exe122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-