Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe
Resource
win7-20240705-en
3 signatures
150 seconds
General
-
Target
0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe
-
Size
465KB
-
MD5
0541ce3a59d1d1c47d805961890d3a91
-
SHA1
10a2149b4274fba729db256c6c64a20ca169b701
-
SHA256
58e47edaad80ce2561635e8d5a91470efb906813702ca86b248945ace23aced1
-
SHA512
ddcb16afdece3aa345ed7a6515b6bc17978e5363e3f9219ee653ce97bab37408899704dc8f929f4a84154c6d4a5a13eff7829f06933b080f527da8615b6b1005
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1HsYigTvo+9:d7Tc9Wj16A3Stvxpig7oM
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1768-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-610-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-666-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-701-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-673-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-655-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-626-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-578-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-565-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-397-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3800 dpjvv.exe 4056 llxxxff.exe 1768 nthnnb.exe 1036 pjpjd.exe 2796 llllfff.exe 3676 vvdvv.exe 3192 tbtnbt.exe 2808 ddvpp.exe 3452 tntttb.exe 2716 dvvvv.exe 4012 lxxfflr.exe 1524 jvddv.exe 4828 ffrxllx.exe 4776 dpjdj.exe 3456 btnhnt.exe 3968 thtnth.exe 1192 3dvjp.exe 2476 fxxfffl.exe 2948 jvpdp.exe 1392 thnnnn.exe 1504 httttb.exe 3528 llrrlll.exe 4944 nntnhn.exe 3164 jjjdp.exe 3608 nnbbnh.exe 1052 ppddd.exe 2512 rxrrllf.exe 4356 bhttbn.exe 4872 ppvvv.exe 4280 xfrrrxl.exe 232 nnnthn.exe 4464 llrxfxf.exe 3680 bnttth.exe 4560 djvdd.exe 2624 7ntttt.exe 4336 djjdd.exe 4576 tttnbn.exe 992 ntbbnt.exe 3580 rxfffxf.exe 2708 nhtntn.exe 4704 dvpdv.exe 2032 rlxxlrr.exe 1736 jvvdp.exe 2396 rlrlfff.exe 2020 tbhnnt.exe 1932 pvjjj.exe 4608 xfrlffr.exe 4412 nhhhhh.exe 380 hnhbbn.exe 3244 vvjjj.exe 4012 9fxxxff.exe 3708 bnnbtb.exe 552 vpddv.exe 4628 fxrlfxx.exe 652 ttbnnn.exe 4452 7nttbh.exe 3456 dvvvp.exe 2332 1ffxxff.exe 2704 hbtttt.exe 3000 dddvj.exe 2476 ttnhhh.exe 3536 httbbh.exe 2428 jjvvv.exe 3752 rfrxrxx.exe -
resource yara_rule behavioral2/memory/1768-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-461-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-532-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-610-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-636-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-656-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-666-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-701-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-723-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-694-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-687-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-673-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-655-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-626-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-578-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-565-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-536-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-519-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-410-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-397-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-265-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbht.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 3800 2192 0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe 84 PID 2192 wrote to memory of 3800 2192 0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe 84 PID 2192 wrote to memory of 3800 2192 0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe 84 PID 3800 wrote to memory of 4056 3800 dpjvv.exe 663 PID 3800 wrote to memory of 4056 3800 dpjvv.exe 663 PID 3800 wrote to memory of 4056 3800 dpjvv.exe 663 PID 4056 wrote to memory of 1768 4056 llxxxff.exe 86 PID 4056 wrote to memory of 1768 4056 llxxxff.exe 86 PID 4056 wrote to memory of 1768 4056 llxxxff.exe 86 PID 1768 wrote to memory of 1036 1768 nthnnb.exe 87 PID 1768 wrote to memory of 1036 1768 nthnnb.exe 87 PID 1768 wrote to memory of 1036 1768 nthnnb.exe 87 PID 1036 wrote to memory of 2796 1036 pjpjd.exe 89 PID 1036 wrote to memory of 2796 1036 pjpjd.exe 89 PID 1036 wrote to memory of 2796 1036 pjpjd.exe 89 PID 2796 wrote to memory of 3676 2796 llllfff.exe 288 PID 2796 wrote to memory of 3676 2796 llllfff.exe 288 PID 2796 wrote to memory of 3676 2796 llllfff.exe 288 PID 3676 wrote to memory of 3192 3676 vvdvv.exe 92 PID 3676 wrote to memory of 3192 3676 vvdvv.exe 92 PID 3676 wrote to memory of 3192 3676 vvdvv.exe 92 PID 3192 wrote to memory of 2808 3192 tbtnbt.exe 93 PID 3192 wrote to memory of 2808 3192 tbtnbt.exe 93 PID 3192 wrote to memory of 2808 3192 tbtnbt.exe 93 PID 2808 wrote to memory of 3452 2808 ddvpp.exe 95 PID 2808 wrote to memory of 3452 2808 ddvpp.exe 95 PID 2808 wrote to memory of 3452 2808 ddvpp.exe 95 PID 3452 wrote to memory of 2716 3452 tntttb.exe 96 PID 3452 wrote to memory of 2716 3452 tntttb.exe 96 PID 3452 wrote to memory of 2716 3452 tntttb.exe 96 PID 2716 wrote to memory of 4012 2716 dvvvv.exe 97 PID 2716 wrote to memory of 4012 2716 dvvvv.exe 97 PID 2716 wrote to memory of 4012 2716 dvvvv.exe 97 PID 4012 wrote to memory of 1524 4012 lxxfflr.exe 98 PID 4012 wrote to memory of 1524 4012 lxxfflr.exe 98 PID 4012 wrote to memory of 1524 4012 lxxfflr.exe 98 PID 1524 wrote to memory of 4828 1524 jvddv.exe 99 PID 1524 wrote to memory of 4828 1524 jvddv.exe 99 PID 1524 wrote to memory of 4828 1524 jvddv.exe 99 PID 4828 wrote to memory of 4776 4828 ffrxllx.exe 100 PID 4828 wrote to memory of 4776 4828 ffrxllx.exe 100 PID 4828 wrote to memory of 4776 4828 ffrxllx.exe 100 PID 4776 wrote to memory of 3456 4776 dpjdj.exe 143 PID 4776 wrote to memory of 3456 4776 dpjdj.exe 143 PID 4776 wrote to memory of 3456 4776 dpjdj.exe 143 PID 3456 wrote to memory of 3968 3456 btnhnt.exe 244 PID 3456 wrote to memory of 3968 3456 btnhnt.exe 244 PID 3456 wrote to memory of 3968 3456 btnhnt.exe 244 PID 3968 wrote to memory of 1192 3968 thtnth.exe 103 PID 3968 wrote to memory of 1192 3968 thtnth.exe 103 PID 3968 wrote to memory of 1192 3968 thtnth.exe 103 PID 1192 wrote to memory of 2476 1192 3dvjp.exe 147 PID 1192 wrote to memory of 2476 1192 3dvjp.exe 147 PID 1192 wrote to memory of 2476 1192 3dvjp.exe 147 PID 2476 wrote to memory of 2948 2476 fxxfffl.exe 1250 PID 2476 wrote to memory of 2948 2476 fxxfffl.exe 1250 PID 2476 wrote to memory of 2948 2476 fxxfffl.exe 1250 PID 2948 wrote to memory of 1392 2948 jvpdp.exe 106 PID 2948 wrote to memory of 1392 2948 jvpdp.exe 106 PID 2948 wrote to memory of 1392 2948 jvpdp.exe 106 PID 1392 wrote to memory of 1504 1392 thnnnn.exe 642 PID 1392 wrote to memory of 1504 1392 thnnnn.exe 642 PID 1392 wrote to memory of 1504 1392 thnnnn.exe 642 PID 1504 wrote to memory of 3528 1504 httttb.exe 1255
Processes
-
C:\Windows\System32\nbrsem.exe"C:\Windows\System32\nbrsem.exe"1⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0541ce3a59d1d1c47d805961890d3a91_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\dpjvv.exec:\dpjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\llxxxff.exec:\llxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\nthnnb.exec:\nthnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\pjpjd.exec:\pjpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\llllfff.exec:\llllfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vvdvv.exec:\vvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\tbtnbt.exec:\tbtnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\ddvpp.exec:\ddvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tntttb.exec:\tntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\dvvvv.exec:\dvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lxxfflr.exec:\lxxfflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\jvddv.exec:\jvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\ffrxllx.exec:\ffrxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\dpjdj.exec:\dpjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\btnhnt.exec:\btnhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\thtnth.exec:\thtnth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\3dvjp.exec:\3dvjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\fxxfffl.exec:\fxxfffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jvpdp.exec:\jvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\thnnnn.exec:\thnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\httttb.exec:\httttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\llrrlll.exec:\llrrlll.exe23⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nntnhn.exec:\nntnhn.exe24⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jjjdp.exec:\jjjdp.exe25⤵
- Executes dropped EXE
PID:3164 -
\??\c:\nnbbnh.exec:\nnbbnh.exe26⤵
- Executes dropped EXE
PID:3608 -
\??\c:\ppddd.exec:\ppddd.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxrrllf.exec:\rxrrllf.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bhttbn.exec:\bhttbn.exe29⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ppvvv.exec:\ppvvv.exe30⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xfrrrxl.exec:\xfrrrxl.exe31⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nnnthn.exec:\nnnthn.exe32⤵
- Executes dropped EXE
PID:232 -
\??\c:\llrxfxf.exec:\llrxfxf.exe33⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bnttth.exec:\bnttth.exe34⤵
- Executes dropped EXE
PID:3680 -
\??\c:\djvdd.exec:\djvdd.exe35⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7ntttt.exec:\7ntttt.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\djjdd.exec:\djjdd.exe37⤵
- Executes dropped EXE
PID:4336 -
\??\c:\tttnbn.exec:\tttnbn.exe38⤵
- Executes dropped EXE
PID:4576 -
\??\c:\ntbbnt.exec:\ntbbnt.exe39⤵
- Executes dropped EXE
PID:992 -
\??\c:\rxfffxf.exec:\rxfffxf.exe40⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nhtntn.exec:\nhtntn.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvpdv.exec:\dvpdv.exe42⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rlxxlrr.exec:\rlxxlrr.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvvdp.exec:\jvvdp.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rlrlfff.exec:\rlrlfff.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tbhnnt.exec:\tbhnnt.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pvjjj.exec:\pvjjj.exe47⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xfrlffr.exec:\xfrlffr.exe48⤵
- Executes dropped EXE
PID:4608 -
\??\c:\nhhhhh.exec:\nhhhhh.exe49⤵
- Executes dropped EXE
PID:4412 -
\??\c:\hnhbbn.exec:\hnhbbn.exe50⤵
- Executes dropped EXE
PID:380 -
\??\c:\vvjjj.exec:\vvjjj.exe51⤵
- Executes dropped EXE
PID:3244 -
\??\c:\9fxxxff.exec:\9fxxxff.exe52⤵
- Executes dropped EXE
PID:4012 -
\??\c:\bnnbtb.exec:\bnnbtb.exe53⤵
- Executes dropped EXE
PID:3708 -
\??\c:\vpddv.exec:\vpddv.exe54⤵
- Executes dropped EXE
PID:552 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe55⤵
- Executes dropped EXE
PID:4628 -
\??\c:\ttbnnn.exec:\ttbnnn.exe56⤵
- Executes dropped EXE
PID:652 -
\??\c:\7nttbh.exec:\7nttbh.exe57⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dvvvp.exec:\dvvvp.exe58⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1ffxxff.exec:\1ffxxff.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbtttt.exec:\hbtttt.exe60⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dddvj.exec:\dddvj.exe61⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ttnhhh.exec:\ttnhhh.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\httbbh.exec:\httbbh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536 -
\??\c:\jjvvv.exec:\jjvvv.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rfrxrxx.exec:\rfrxrxx.exe65⤵
- Executes dropped EXE
PID:3752 -
\??\c:\nhnttb.exec:\nhnttb.exe66⤵PID:1828
-
\??\c:\btntnn.exec:\btntnn.exe67⤵PID:1380
-
\??\c:\djppp.exec:\djppp.exe68⤵PID:2864
-
\??\c:\lrllrxl.exec:\lrllrxl.exe69⤵PID:3384
-
\??\c:\3bntht.exec:\3bntht.exe70⤵PID:3636
-
\??\c:\tbhnbb.exec:\tbhnbb.exe71⤵PID:2816
-
\??\c:\vdvvj.exec:\vdvvj.exe72⤵PID:4972
-
\??\c:\xxxfxff.exec:\xxxfxff.exe73⤵PID:2640
-
\??\c:\7hbbnn.exec:\7hbbnn.exe74⤵PID:1072
-
\??\c:\3bnnnt.exec:\3bnnnt.exe75⤵PID:2920
-
\??\c:\jpvvv.exec:\jpvvv.exe76⤵PID:3984
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe77⤵PID:2480
-
\??\c:\nhbnbn.exec:\nhbnbn.exe78⤵PID:3860
-
\??\c:\jjpvj.exec:\jjpvj.exe79⤵
- System Location Discovery: System Language Discovery
PID:1200 -
\??\c:\vddvd.exec:\vddvd.exe80⤵PID:1696
-
\??\c:\lrxxffl.exec:\lrxxffl.exe81⤵PID:4560
-
\??\c:\5btbbb.exec:\5btbbb.exe82⤵PID:2624
-
\??\c:\djdvj.exec:\djdvj.exe83⤵PID:4336
-
\??\c:\jjjjj.exec:\jjjjj.exe84⤵PID:2192
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe85⤵PID:4368
-
\??\c:\hhnhtn.exec:\hhnhtn.exe86⤵PID:1896
-
\??\c:\3vddd.exec:\3vddd.exe87⤵PID:1512
-
\??\c:\xrrrrlx.exec:\xrrrrlx.exe88⤵PID:1648
-
\??\c:\tbtbnh.exec:\tbtbnh.exe89⤵PID:832
-
\??\c:\nhhhbh.exec:\nhhhbh.exe90⤵PID:1616
-
\??\c:\3pvpp.exec:\3pvpp.exe91⤵PID:1308
-
\??\c:\lrrlllr.exec:\lrrlllr.exe92⤵PID:2380
-
\??\c:\fxrllrl.exec:\fxrllrl.exe93⤵PID:3192
-
\??\c:\tnnnnh.exec:\tnnnnh.exe94⤵PID:4864
-
\??\c:\pdppj.exec:\pdppj.exe95⤵PID:3560
-
\??\c:\xfxrlrl.exec:\xfxrlrl.exe96⤵PID:3704
-
\??\c:\tbtbht.exec:\tbtbht.exe97⤵
- System Location Discovery: System Language Discovery
PID:4832 -
\??\c:\tbhtth.exec:\tbhtth.exe98⤵PID:3540
-
\??\c:\jpjdv.exec:\jpjdv.exe99⤵PID:3244
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe100⤵PID:1524
-
\??\c:\ttbbbb.exec:\ttbbbb.exe101⤵PID:4052
-
\??\c:\tbhttt.exec:\tbhttt.exe102⤵PID:4984
-
\??\c:\vpjjj.exec:\vpjjj.exe103⤵PID:552
-
\??\c:\lrxflrr.exec:\lrxflrr.exe104⤵PID:4628
-
\??\c:\hbbbht.exec:\hbbbht.exe105⤵PID:2112
-
\??\c:\jpvvv.exec:\jpvvv.exe106⤵PID:2588
-
\??\c:\9vjdd.exec:\9vjdd.exe107⤵PID:3456
-
\??\c:\xrxfflr.exec:\xrxfflr.exe108⤵PID:4860
-
\??\c:\hthbtt.exec:\hthbtt.exe109⤵PID:3996
-
\??\c:\vdpjj.exec:\vdpjj.exe110⤵PID:4120
-
\??\c:\ffllllf.exec:\ffllllf.exe111⤵PID:2768
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe112⤵PID:5088
-
\??\c:\9bhttb.exec:\9bhttb.exe113⤵PID:1464
-
\??\c:\pdpdj.exec:\pdpdj.exe114⤵PID:4508
-
\??\c:\xflfrrr.exec:\xflfrrr.exe115⤵PID:3336
-
\??\c:\rffllrr.exec:\rffllrr.exe116⤵PID:428
-
\??\c:\nbtttt.exec:\nbtttt.exe117⤵PID:3588
-
\??\c:\dvjjj.exec:\dvjjj.exe118⤵PID:4944
-
\??\c:\lrrlrfr.exec:\lrrlrfr.exe119⤵PID:4528
-
\??\c:\5hbbbh.exec:\5hbbbh.exe120⤵PID:3052
-
\??\c:\pdjdj.exec:\pdjdj.exe121⤵PID:2872
-
\??\c:\dppjp.exec:\dppjp.exe122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-