Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0472547823c9419605a1514cf582e323_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0472547823c9419605a1514cf582e323_JaffaCakes118.exe
-
Size
452KB
-
MD5
0472547823c9419605a1514cf582e323
-
SHA1
2518af8bf595b294d7bd821f9a722a3b70aa5afc
-
SHA256
b2d94bee233c9e0c887b9d64fdab5200436a50e1399166480af56d78326cb7fc
-
SHA512
5c04c0093f8c3c268341ec988cabf31b05cbbe1bec84ee83833fa6e8d0f56a0eb352213db81a779594bd873cef8f4ff39f1342a47d48e1631c41e58cdb2e3cd7
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1H6I+N:d7Tc9Wj16A3Stvx6I+N
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2764-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1300-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-185-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/3040-187-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2080-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-462-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-476-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-658-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-665-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-721-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2920-872-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-893-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-900-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-1051-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 xrxxllx.exe 2828 3hbnbb.exe 2932 btnnbh.exe 2600 pjdvj.exe 2564 tthnbb.exe 2228 bnhnbb.exe 1764 lffrxxf.exe 2884 nnhhth.exe 332 7vvjv.exe 1880 xrlflrx.exe 912 jdppv.exe 2864 rrrfxfr.exe 2896 dpvvv.exe 2960 dvjvj.exe 2356 nnnnnn.exe 2540 pdvdv.exe 1148 9xrxflr.exe 1032 7nhnbn.exe 1300 ffrfrrl.exe 3040 3tbbtn.exe 2056 ppvpv.exe 2080 btnbhn.exe 948 dvjjp.exe 1296 xlfrrxr.exe 2216 pjjpj.exe 3012 hhbbnh.exe 2196 pvvvd.exe 1796 rxrxrfx.exe 1488 hhbnhh.exe 2288 pvpdp.exe 2644 9hhnhh.exe 2464 ddvdp.exe 1604 bbbnhb.exe 2764 vvjdj.exe 2404 1lllrxf.exe 2676 9bttbn.exe 1984 7bbhnb.exe 2792 vdvjv.exe 1756 5llrxll.exe 2232 bbbnnb.exe 2324 djddp.exe 1544 7rlrflf.exe 764 rfllrll.exe 1308 7tntbh.exe 332 xxrxlrl.exe 2648 1rrrflx.exe 2876 bhhhbt.exe 912 3jvjv.exe 2880 7xxlfrf.exe 2944 lrrxlrl.exe 3060 5bthhh.exe 2800 1jjpv.exe 1724 frfxlfl.exe 560 1tbbtt.exe 2776 pjjdp.exe 1148 vpddj.exe 2180 lxlxflx.exe 1744 7btbhn.exe 2108 7dpdj.exe 844 dpddv.exe 2364 flxfrrx.exe 1616 btntbh.exe 1872 ddppv.exe 1320 xrllxlr.exe -
resource yara_rule behavioral1/memory/2764-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1300-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-462-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-476-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-477-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-550-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-557-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-619-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-644-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-658-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-665-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-678-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-734-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-741-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-748-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-839-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-847-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-872-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-886-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-893-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-900-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-919-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/972-980-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-1000-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1940-1058-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-1120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-1158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-1165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-1178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-1185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2836 2764 0472547823c9419605a1514cf582e323_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2836 2764 0472547823c9419605a1514cf582e323_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2836 2764 0472547823c9419605a1514cf582e323_JaffaCakes118.exe 30 PID 2764 wrote to memory of 2836 2764 0472547823c9419605a1514cf582e323_JaffaCakes118.exe 30 PID 2836 wrote to memory of 2828 2836 xrxxllx.exe 31 PID 2836 wrote to memory of 2828 2836 xrxxllx.exe 31 PID 2836 wrote to memory of 2828 2836 xrxxllx.exe 31 PID 2836 wrote to memory of 2828 2836 xrxxllx.exe 31 PID 2828 wrote to memory of 2932 2828 3hbnbb.exe 32 PID 2828 wrote to memory of 2932 2828 3hbnbb.exe 32 PID 2828 wrote to memory of 2932 2828 3hbnbb.exe 32 PID 2828 wrote to memory of 2932 2828 3hbnbb.exe 32 PID 2932 wrote to memory of 2600 2932 btnnbh.exe 33 PID 2932 wrote to memory of 2600 2932 btnnbh.exe 33 PID 2932 wrote to memory of 2600 2932 btnnbh.exe 33 PID 2932 wrote to memory of 2600 2932 btnnbh.exe 33 PID 2600 wrote to memory of 2564 2600 pjdvj.exe 34 PID 2600 wrote to memory of 2564 2600 pjdvj.exe 34 PID 2600 wrote to memory of 2564 2600 pjdvj.exe 34 PID 2600 wrote to memory of 2564 2600 pjdvj.exe 34 PID 2564 wrote to memory of 2228 2564 tthnbb.exe 35 PID 2564 wrote to memory of 2228 2564 tthnbb.exe 35 PID 2564 wrote to memory of 2228 2564 tthnbb.exe 35 PID 2564 wrote to memory of 2228 2564 tthnbb.exe 35 PID 2228 wrote to memory of 1764 2228 bnhnbb.exe 36 PID 2228 wrote to memory of 1764 2228 bnhnbb.exe 36 PID 2228 wrote to memory of 1764 2228 bnhnbb.exe 36 PID 2228 wrote to memory of 1764 2228 bnhnbb.exe 36 PID 1764 wrote to memory of 2884 1764 lffrxxf.exe 37 PID 1764 wrote to memory of 2884 1764 lffrxxf.exe 37 PID 1764 wrote to memory of 2884 1764 lffrxxf.exe 37 PID 1764 wrote to memory of 2884 1764 lffrxxf.exe 37 PID 2884 wrote to memory of 332 2884 nnhhth.exe 38 PID 2884 wrote to memory of 332 2884 nnhhth.exe 38 PID 2884 wrote to memory of 332 2884 nnhhth.exe 38 PID 2884 wrote to memory of 332 2884 nnhhth.exe 38 PID 332 wrote to memory of 1880 332 7vvjv.exe 39 PID 332 wrote to memory of 1880 332 7vvjv.exe 39 PID 332 wrote to memory of 1880 332 7vvjv.exe 39 PID 332 wrote to memory of 1880 332 7vvjv.exe 39 PID 1880 wrote to memory of 912 1880 xrlflrx.exe 40 PID 1880 wrote to memory of 912 1880 xrlflrx.exe 40 PID 1880 wrote to memory of 912 1880 xrlflrx.exe 40 PID 1880 wrote to memory of 912 1880 xrlflrx.exe 40 PID 912 wrote to memory of 2864 912 jdppv.exe 41 PID 912 wrote to memory of 2864 912 jdppv.exe 41 PID 912 wrote to memory of 2864 912 jdppv.exe 41 PID 912 wrote to memory of 2864 912 jdppv.exe 41 PID 2864 wrote to memory of 2896 2864 rrrfxfr.exe 42 PID 2864 wrote to memory of 2896 2864 rrrfxfr.exe 42 PID 2864 wrote to memory of 2896 2864 rrrfxfr.exe 42 PID 2864 wrote to memory of 2896 2864 rrrfxfr.exe 42 PID 2896 wrote to memory of 2960 2896 dpvvv.exe 43 PID 2896 wrote to memory of 2960 2896 dpvvv.exe 43 PID 2896 wrote to memory of 2960 2896 dpvvv.exe 43 PID 2896 wrote to memory of 2960 2896 dpvvv.exe 43 PID 2960 wrote to memory of 2356 2960 dvjvj.exe 44 PID 2960 wrote to memory of 2356 2960 dvjvj.exe 44 PID 2960 wrote to memory of 2356 2960 dvjvj.exe 44 PID 2960 wrote to memory of 2356 2960 dvjvj.exe 44 PID 2356 wrote to memory of 2540 2356 nnnnnn.exe 45 PID 2356 wrote to memory of 2540 2356 nnnnnn.exe 45 PID 2356 wrote to memory of 2540 2356 nnnnnn.exe 45 PID 2356 wrote to memory of 2540 2356 nnnnnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0472547823c9419605a1514cf582e323_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0472547823c9419605a1514cf582e323_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrxxllx.exec:\xrxxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3hbnbb.exec:\3hbnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\btnnbh.exec:\btnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pjdvj.exec:\pjdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tthnbb.exec:\tthnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bnhnbb.exec:\bnhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\lffrxxf.exec:\lffrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nnhhth.exec:\nnhhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7vvjv.exec:\7vvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\xrlflrx.exec:\xrlflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\jdppv.exec:\jdppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\rrrfxfr.exec:\rrrfxfr.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dpvvv.exec:\dpvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dvjvj.exec:\dvjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nnnnnn.exec:\nnnnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pdvdv.exec:\pdvdv.exe17⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9xrxflr.exec:\9xrxflr.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7nhnbn.exec:\7nhnbn.exe19⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe20⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3tbbtn.exec:\3tbbtn.exe21⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ppvpv.exec:\ppvpv.exe22⤵
- Executes dropped EXE
PID:2056 -
\??\c:\btnbhn.exec:\btnbhn.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:948 -
\??\c:\xlfrrxr.exec:\xlfrrxr.exe25⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pjjpj.exec:\pjjpj.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hhbbnh.exec:\hhbbnh.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pvvvd.exec:\pvvvd.exe28⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxrxrfx.exec:\rxrxrfx.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhbnhh.exec:\hhbnhh.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pvpdp.exec:\pvpdp.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9hhnhh.exec:\9hhnhh.exe32⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddvdp.exec:\ddvdp.exe33⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbbnhb.exec:\bbbnhb.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvjdj.exec:\vvjdj.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1lllrxf.exec:\1lllrxf.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9bttbn.exec:\9bttbn.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7bbhnb.exec:\7bbhnb.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vdvjv.exec:\vdvjv.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5llrxll.exec:\5llrxll.exe40⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bbbnnb.exec:\bbbnnb.exe41⤵
- Executes dropped EXE
PID:2232 -
\??\c:\djddp.exec:\djddp.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7rlrflf.exec:\7rlrflf.exe43⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rfllrll.exec:\rfllrll.exe44⤵
- Executes dropped EXE
PID:764 -
\??\c:\7tntbh.exec:\7tntbh.exe45⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe46⤵
- Executes dropped EXE
PID:332 -
\??\c:\1rrrflx.exec:\1rrrflx.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bhhhbt.exec:\bhhhbt.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3jvjv.exec:\3jvjv.exe49⤵
- Executes dropped EXE
PID:912 -
\??\c:\7xxlfrf.exec:\7xxlfrf.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lrrxlrl.exec:\lrrxlrl.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5bthhh.exec:\5bthhh.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1jjpv.exec:\1jjpv.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frfxlfl.exec:\frfxlfl.exe54⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1tbbtt.exec:\1tbbtt.exe55⤵
- Executes dropped EXE
PID:560 -
\??\c:\pjjdp.exec:\pjjdp.exe56⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpddj.exec:\vpddj.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lxlxflx.exec:\lxlxflx.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7btbhn.exec:\7btbhn.exe59⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7dpdj.exec:\7dpdj.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dpddv.exec:\dpddv.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\flxfrrx.exec:\flxfrrx.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\btntbh.exec:\btntbh.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ddppv.exec:\ddppv.exe64⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xrllxlr.exec:\xrllxlr.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbnnbh.exec:\hbnnbh.exe66⤵PID:2028
-
\??\c:\hthbnb.exec:\hthbnb.exe67⤵PID:1940
-
\??\c:\pjjpd.exec:\pjjpd.exe68⤵PID:1868
-
\??\c:\7ffflll.exec:\7ffflll.exe69⤵PID:2160
-
\??\c:\hbbnhb.exec:\hbbnhb.exe70⤵PID:2284
-
\??\c:\dvvdv.exec:\dvvdv.exe71⤵PID:2436
-
\??\c:\frfflrr.exec:\frfflrr.exe72⤵PID:1504
-
\??\c:\tbtthh.exec:\tbtthh.exe73⤵PID:2288
-
\??\c:\vvvvp.exec:\vvvvp.exe74⤵PID:1584
-
\??\c:\3jdpv.exec:\3jdpv.exe75⤵PID:1568
-
\??\c:\rxlxlrf.exec:\rxlxlrf.exe76⤵PID:2756
-
\??\c:\tnnbtt.exec:\tnnbtt.exe77⤵PID:2836
-
\??\c:\1vjpj.exec:\1vjpj.exe78⤵PID:2744
-
\??\c:\vvpdp.exec:\vvpdp.exe79⤵PID:2888
-
\??\c:\rxxfflx.exec:\rxxfflx.exe80⤵PID:2716
-
\??\c:\3ttbnt.exec:\3ttbnt.exe81⤵PID:2552
-
\??\c:\vvpdj.exec:\vvpdj.exe82⤵PID:2628
-
\??\c:\1jvdp.exec:\1jvdp.exe83⤵PID:1756
-
\??\c:\rlxrxlf.exec:\rlxrxlf.exe84⤵PID:2232
-
\??\c:\nnhnhh.exec:\nnhnhh.exe85⤵PID:2324
-
\??\c:\hhthnb.exec:\hhthnb.exe86⤵PID:1544
-
\??\c:\pvppj.exec:\pvppj.exe87⤵PID:764
-
\??\c:\rxrrxrl.exec:\rxrrxrl.exe88⤵PID:2408
-
\??\c:\5hbttb.exec:\5hbttb.exe89⤵PID:1552
-
\??\c:\vvpjv.exec:\vvpjv.exe90⤵PID:2532
-
\??\c:\xrrffrr.exec:\xrrffrr.exe91⤵PID:3064
-
\??\c:\3fxffrf.exec:\3fxffrf.exe92⤵PID:2736
-
\??\c:\btbnbn.exec:\btbnbn.exe93⤵PID:2864
-
\??\c:\vvpjd.exec:\vvpjd.exe94⤵PID:2944
-
\??\c:\ddddp.exec:\ddddp.exe95⤵PID:3060
-
\??\c:\fxrxfrl.exec:\fxrxfrl.exe96⤵PID:2800
-
\??\c:\hnttnn.exec:\hnttnn.exe97⤵PID:1484
-
\??\c:\nnhnhh.exec:\nnhnhh.exe98⤵PID:1480
-
\??\c:\ppvjd.exec:\ppvjd.exe99⤵PID:2776
-
\??\c:\7fffrfl.exec:\7fffrfl.exe100⤵PID:2128
-
\??\c:\nnthbb.exec:\nnthbb.exe101⤵PID:1032
-
\??\c:\1htbnt.exec:\1htbnt.exe102⤵PID:676
-
\??\c:\3dppv.exec:\3dppv.exe103⤵PID:2016
-
\??\c:\rrllrxl.exec:\rrllrxl.exe104⤵PID:1268
-
\??\c:\btttht.exec:\btttht.exe105⤵PID:2396
-
\??\c:\jjdpd.exec:\jjdpd.exe106⤵PID:2332
-
\??\c:\flrffxx.exec:\flrffxx.exe107⤵PID:1536
-
\??\c:\tbttnn.exec:\tbttnn.exe108⤵PID:2304
-
\??\c:\thhtbt.exec:\thhtbt.exe109⤵PID:2216
-
\??\c:\jvvjv.exec:\jvvjv.exe110⤵PID:1876
-
\??\c:\xlxrxfl.exec:\xlxrxfl.exe111⤵PID:2196
-
\??\c:\hhtbnt.exec:\hhtbnt.exe112⤵PID:2220
-
\??\c:\hhnbhb.exec:\hhnbhb.exe113⤵PID:1816
-
\??\c:\vjjdv.exec:\vjjdv.exe114⤵PID:1944
-
\??\c:\7ffllfl.exec:\7ffllfl.exe115⤵PID:2436
-
\??\c:\vpdpp.exec:\vpdpp.exe116⤵PID:1256
-
\??\c:\1lxrrlr.exec:\1lxrrlr.exe117⤵PID:2644
-
\??\c:\htnbnt.exec:\htnbnt.exe118⤵PID:2780
-
\??\c:\pjppp.exec:\pjppp.exe119⤵PID:1592
-
\??\c:\9lflxxx.exec:\9lflxxx.exe120⤵PID:2772
-
\??\c:\hnhbtn.exec:\hnhbtn.exe121⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-