Analysis
-
max time kernel
49s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe
-
Size
210KB
-
MD5
05250f7756f9b48e8f52948fdf085d1b
-
SHA1
a910045cf26b205b51129c8093c49f7727bfcb4f
-
SHA256
77f8aea4b6cb7f0ae06b41143dd44eb1b342d6db450eac8fae7006d7a7fa94a3
-
SHA512
56b66c84edb59e4aef169de32f71a1358d7d2b61b9d31b3c478753c8d04cda4eefb6e1efa7480f203334af6012a09e4f69cd9182befa2613873c828012764c95
-
SSDEEP
3072:EhOm2sI93UufdC67ciyt3ujFf7TQsq5VaQvytQ0:Ecm7ImGddXyt38TU5L0
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral2/memory/4940-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 hbtbhn.exe 3840 3bnhtt.exe 2436 jdvpp.exe 2776 fffrrrf.exe 3780 7nnhbn.exe 5064 pvjjj.exe 4940 xxllxxf.exe 4420 hhtthh.exe 3944 vjjvp.exe 676 rlxrrll.exe 4488 lxlxlxl.exe 4912 ntttnn.exe 1864 ppdpd.exe 4820 7llfxxr.exe 3920 nnbtnt.exe 4796 dddvv.exe 3644 xxrrrxr.exe 4904 vpddv.exe 888 rlrllxl.exe 2008 bthbtb.exe 4672 dvjdj.exe 400 fxxxrfx.exe 2128 btnnbh.exe 2916 jjdpp.exe 3872 rrlllrr.exe 2500 bhbtbn.exe 920 pjjjj.exe 3124 llxfxrl.exe 4652 1dppj.exe 2044 djjpd.exe 2320 lxrllrr.exe 3492 nhtbtb.exe 3628 pjvvp.exe 3800 lxfxxfr.exe 2232 hhttth.exe 2744 vvdjj.exe 4648 djpjd.exe 4384 fxxlfff.exe 1520 nntthn.exe 1564 vppdj.exe 3196 llfrfrr.exe 2436 7hbbbt.exe 4880 nhttnn.exe 692 7vppp.exe 1204 lfxxffx.exe 3392 xlrlffl.exe 4888 1hnhhb.exe 3944 ppdvv.exe 4572 jvddv.exe 1432 xrffflx.exe 3284 1bnhhh.exe 1988 bhbtbh.exe 3236 jjpdv.exe 8 jvdpp.exe 1704 fxrrxfx.exe 3688 nhhbbb.exe 936 hhnnhb.exe 3984 xffffll.exe 4580 httnhn.exe 4052 bnhhtn.exe 1020 djvvd.exe 1060 fxfxfrf.exe 3308 9xxrllf.exe 2884 nthtnt.exe -
resource yara_rule behavioral2/memory/2456-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-985-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-304-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 2456 4288 05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe 84 PID 4288 wrote to memory of 2456 4288 05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe 84 PID 4288 wrote to memory of 2456 4288 05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe 84 PID 2456 wrote to memory of 3840 2456 hbtbhn.exe 85 PID 2456 wrote to memory of 3840 2456 hbtbhn.exe 85 PID 2456 wrote to memory of 3840 2456 hbtbhn.exe 85 PID 3840 wrote to memory of 2436 3840 3bnhtt.exe 86 PID 3840 wrote to memory of 2436 3840 3bnhtt.exe 86 PID 3840 wrote to memory of 2436 3840 3bnhtt.exe 86 PID 2436 wrote to memory of 2776 2436 jdvpp.exe 87 PID 2436 wrote to memory of 2776 2436 jdvpp.exe 87 PID 2436 wrote to memory of 2776 2436 jdvpp.exe 87 PID 2776 wrote to memory of 3780 2776 fffrrrf.exe 88 PID 2776 wrote to memory of 3780 2776 fffrrrf.exe 88 PID 2776 wrote to memory of 3780 2776 fffrrrf.exe 88 PID 3780 wrote to memory of 5064 3780 7nnhbn.exe 89 PID 3780 wrote to memory of 5064 3780 7nnhbn.exe 89 PID 3780 wrote to memory of 5064 3780 7nnhbn.exe 89 PID 5064 wrote to memory of 4940 5064 pvjjj.exe 91 PID 5064 wrote to memory of 4940 5064 pvjjj.exe 91 PID 5064 wrote to memory of 4940 5064 pvjjj.exe 91 PID 4940 wrote to memory of 4420 4940 xxllxxf.exe 92 PID 4940 wrote to memory of 4420 4940 xxllxxf.exe 92 PID 4940 wrote to memory of 4420 4940 xxllxxf.exe 92 PID 4420 wrote to memory of 3944 4420 hhtthh.exe 93 PID 4420 wrote to memory of 3944 4420 hhtthh.exe 93 PID 4420 wrote to memory of 3944 4420 hhtthh.exe 93 PID 3944 wrote to memory of 676 3944 vjjvp.exe 95 PID 3944 wrote to memory of 676 3944 vjjvp.exe 95 PID 3944 wrote to memory of 676 3944 vjjvp.exe 95 PID 676 wrote to memory of 4488 676 rlxrrll.exe 738 PID 676 wrote to memory of 4488 676 rlxrrll.exe 738 PID 676 wrote to memory of 4488 676 rlxrrll.exe 738 PID 4488 wrote to memory of 4912 4488 lxlxlxl.exe 97 PID 4488 wrote to memory of 4912 4488 lxlxlxl.exe 97 PID 4488 wrote to memory of 4912 4488 lxlxlxl.exe 97 PID 4912 wrote to memory of 1864 4912 ntttnn.exe 98 PID 4912 wrote to memory of 1864 4912 ntttnn.exe 98 PID 4912 wrote to memory of 1864 4912 ntttnn.exe 98 PID 1864 wrote to memory of 4820 1864 ppdpd.exe 343 PID 1864 wrote to memory of 4820 1864 ppdpd.exe 343 PID 1864 wrote to memory of 4820 1864 ppdpd.exe 343 PID 4820 wrote to memory of 3920 4820 7llfxxr.exe 101 PID 4820 wrote to memory of 3920 4820 7llfxxr.exe 101 PID 4820 wrote to memory of 3920 4820 7llfxxr.exe 101 PID 3920 wrote to memory of 4796 3920 nnbtnt.exe 102 PID 3920 wrote to memory of 4796 3920 nnbtnt.exe 102 PID 3920 wrote to memory of 4796 3920 nnbtnt.exe 102 PID 4796 wrote to memory of 3644 4796 dddvv.exe 103 PID 4796 wrote to memory of 3644 4796 dddvv.exe 103 PID 4796 wrote to memory of 3644 4796 dddvv.exe 103 PID 3644 wrote to memory of 4904 3644 xxrrrxr.exe 104 PID 3644 wrote to memory of 4904 3644 xxrrrxr.exe 104 PID 3644 wrote to memory of 4904 3644 xxrrrxr.exe 104 PID 4904 wrote to memory of 888 4904 vpddv.exe 105 PID 4904 wrote to memory of 888 4904 vpddv.exe 105 PID 4904 wrote to memory of 888 4904 vpddv.exe 105 PID 888 wrote to memory of 2008 888 rlrllxl.exe 106 PID 888 wrote to memory of 2008 888 rlrllxl.exe 106 PID 888 wrote to memory of 2008 888 rlrllxl.exe 106 PID 2008 wrote to memory of 4672 2008 bthbtb.exe 107 PID 2008 wrote to memory of 4672 2008 bthbtb.exe 107 PID 2008 wrote to memory of 4672 2008 bthbtb.exe 107 PID 4672 wrote to memory of 400 4672 dvjdj.exe 108
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05250f7756f9b48e8f52948fdf085d1b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\hbtbhn.exec:\hbtbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\3bnhtt.exec:\3bnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\jdvpp.exec:\jdvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fffrrrf.exec:\fffrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7nnhbn.exec:\7nnhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\pvjjj.exec:\pvjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\xxllxxf.exec:\xxllxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hhtthh.exec:\hhtthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\vjjvp.exec:\vjjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\rlxrrll.exec:\rlxrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\lxlxlxl.exec:\lxlxlxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\ntttnn.exec:\ntttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\ppdpd.exec:\ppdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\7llfxxr.exec:\7llfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\nnbtnt.exec:\nnbtnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\dddvv.exec:\dddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\xxrrrxr.exec:\xxrrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\vpddv.exec:\vpddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\rlrllxl.exec:\rlrllxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\bthbtb.exec:\bthbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dvjdj.exec:\dvjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\fxxxrfx.exec:\fxxxrfx.exe23⤵
- Executes dropped EXE
PID:400 -
\??\c:\btnnbh.exec:\btnnbh.exe24⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jjdpp.exec:\jjdpp.exe25⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rrlllrr.exec:\rrlllrr.exe26⤵
- Executes dropped EXE
PID:3872 -
\??\c:\bhbtbn.exec:\bhbtbn.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjjjj.exec:\pjjjj.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\llxfxrl.exec:\llxfxrl.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\1dppj.exec:\1dppj.exe30⤵
- Executes dropped EXE
PID:4652 -
\??\c:\djjpd.exec:\djjpd.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxrllrr.exec:\lxrllrr.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhtbtb.exec:\nhtbtb.exe33⤵
- Executes dropped EXE
PID:3492 -
\??\c:\pjvvp.exec:\pjvvp.exe34⤵
- Executes dropped EXE
PID:3628 -
\??\c:\lxfxxfr.exec:\lxfxxfr.exe35⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hhttth.exec:\hhttth.exe36⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vvdjj.exec:\vvdjj.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\djpjd.exec:\djpjd.exe38⤵
- Executes dropped EXE
PID:4648 -
\??\c:\fxxlfff.exec:\fxxlfff.exe39⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nntthn.exec:\nntthn.exe40⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vppdj.exec:\vppdj.exe41⤵
- Executes dropped EXE
PID:1564 -
\??\c:\llfrfrr.exec:\llfrfrr.exe42⤵
- Executes dropped EXE
PID:3196 -
\??\c:\7hbbbt.exec:\7hbbbt.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nhttnn.exec:\nhttnn.exe44⤵
- Executes dropped EXE
PID:4880 -
\??\c:\7vppp.exec:\7vppp.exe45⤵
- Executes dropped EXE
PID:692 -
\??\c:\lfxxffx.exec:\lfxxffx.exe46⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xlrlffl.exec:\xlrlffl.exe47⤵
- Executes dropped EXE
PID:3392 -
\??\c:\1hnhhb.exec:\1hnhhb.exe48⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ppdvv.exec:\ppdvv.exe49⤵
- Executes dropped EXE
PID:3944 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xrffflx.exec:\xrffflx.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1bnhhh.exec:\1bnhhh.exe52⤵
- Executes dropped EXE
PID:3284 -
\??\c:\bhbtbh.exec:\bhbtbh.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jjpdv.exec:\jjpdv.exe54⤵
- Executes dropped EXE
PID:3236 -
\??\c:\jvdpp.exec:\jvdpp.exe55⤵
- Executes dropped EXE
PID:8 -
\??\c:\fxrrxfx.exec:\fxrrxfx.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nhhbbb.exec:\nhhbbb.exe57⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hhnnhb.exec:\hhnnhb.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\xffffll.exec:\xffffll.exe59⤵
- Executes dropped EXE
PID:3984 -
\??\c:\httnhn.exec:\httnhn.exe60⤵
- Executes dropped EXE
PID:4580 -
\??\c:\bnhhtn.exec:\bnhhtn.exe61⤵
- Executes dropped EXE
PID:4052 -
\??\c:\djvvd.exec:\djvvd.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fxfxfrf.exec:\fxfxfrf.exe63⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9xxrllf.exec:\9xxrllf.exe64⤵
- Executes dropped EXE
PID:3308 -
\??\c:\nthtnt.exec:\nthtnt.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ppvpv.exec:\ppvpv.exe66⤵PID:1272
-
\??\c:\jvdjv.exec:\jvdjv.exe67⤵PID:1368
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe68⤵PID:1824
-
\??\c:\bbbttb.exec:\bbbttb.exe69⤵PID:1584
-
\??\c:\jpjjv.exec:\jpjjv.exe70⤵PID:1332
-
\??\c:\pvvpj.exec:\pvvpj.exe71⤵PID:220
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe72⤵PID:3496
-
\??\c:\5bhbnh.exec:\5bhbnh.exe73⤵PID:3672
-
\??\c:\vdjvv.exec:\vdjvv.exe74⤵PID:2736
-
\??\c:\xrfflxl.exec:\xrfflxl.exe75⤵PID:3296
-
\??\c:\hhtthh.exec:\hhtthh.exe76⤵PID:1500
-
\??\c:\7bbnnn.exec:\7bbnnn.exe77⤵PID:3692
-
\??\c:\ddjpp.exec:\ddjpp.exe78⤵PID:4960
-
\??\c:\rlxffxl.exec:\rlxffxl.exe79⤵PID:2036
-
\??\c:\fffxxrr.exec:\fffxxrr.exe80⤵PID:2672
-
\??\c:\btttnt.exec:\btttnt.exe81⤵PID:2232
-
\??\c:\djvpv.exec:\djvpv.exe82⤵PID:4392
-
\??\c:\jddvv.exec:\jddvv.exe83⤵PID:4396
-
\??\c:\lxrfxlx.exec:\lxrfxlx.exe84⤵PID:4384
-
\??\c:\nbnhnn.exec:\nbnhnn.exe85⤵PID:1520
-
\??\c:\hhhbnh.exec:\hhhbnh.exe86⤵PID:2596
-
\??\c:\jjvdj.exec:\jjvdj.exe87⤵PID:684
-
\??\c:\llfxrrr.exec:\llfxrrr.exe88⤵PID:2776
-
\??\c:\lrfxrxl.exec:\lrfxrxl.exe89⤵PID:760
-
\??\c:\hntnhb.exec:\hntnhb.exe90⤵PID:1384
-
\??\c:\bbtnbt.exec:\bbtnbt.exe91⤵PID:3060
-
\??\c:\jjvpp.exec:\jjvpp.exe92⤵PID:100
-
\??\c:\rlxffff.exec:\rlxffff.exe93⤵PID:396
-
\??\c:\nbtnnn.exec:\nbtnnn.exe94⤵PID:3392
-
\??\c:\tnhbtn.exec:\tnhbtn.exe95⤵PID:4888
-
\??\c:\1vvpj.exec:\1vvpj.exe96⤵PID:3944
-
\??\c:\vppdd.exec:\vppdd.exe97⤵PID:2632
-
\??\c:\lxxxfrr.exec:\lxxxfrr.exe98⤵PID:4900
-
\??\c:\hhbtnh.exec:\hhbtnh.exe99⤵PID:3284
-
\??\c:\9pddj.exec:\9pddj.exe100⤵PID:1988
-
\??\c:\vppjj.exec:\vppjj.exe101⤵PID:3236
-
\??\c:\nnhbtn.exec:\nnhbtn.exe102⤵PID:8
-
\??\c:\jpjjp.exec:\jpjjp.exe103⤵PID:1704
-
\??\c:\lrffrrr.exec:\lrffrrr.exe104⤵PID:2908
-
\??\c:\1bnhht.exec:\1bnhht.exe105⤵PID:5072
-
\??\c:\bbhhhh.exec:\bbhhhh.exe106⤵PID:232
-
\??\c:\jdvvp.exec:\jdvvp.exe107⤵PID:3504
-
\??\c:\5jvpp.exec:\5jvpp.exe108⤵PID:4580
-
\??\c:\llxrfxr.exec:\llxrfxr.exe109⤵PID:1976
-
\??\c:\nttbhh.exec:\nttbhh.exe110⤵PID:3028
-
\??\c:\btntnb.exec:\btntnb.exe111⤵PID:2948
-
\??\c:\djvpj.exec:\djvpj.exe112⤵PID:400
-
\??\c:\pjppv.exec:\pjppv.exe113⤵PID:4388
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe114⤵PID:1676
-
\??\c:\bntnnt.exec:\bntnnt.exe115⤵PID:548
-
\??\c:\nhhhbb.exec:\nhhhbb.exe116⤵
- System Location Discovery: System Language Discovery
PID:4600 -
\??\c:\jdjvd.exec:\jdjvd.exe117⤵PID:2484
-
\??\c:\jjdvp.exec:\jjdvp.exe118⤵PID:1580
-
\??\c:\lxffxxr.exec:\lxffxxr.exe119⤵PID:2892
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe120⤵PID:4784
-
\??\c:\tbhbbt.exec:\tbhbbt.exe121⤵PID:1156
-
\??\c:\vpvpj.exec:\vpvpj.exe122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-