Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
050204638c21d977042b278a848759b7_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
050204638c21d977042b278a848759b7_JaffaCakes118.exe
-
Size
459KB
-
MD5
050204638c21d977042b278a848759b7
-
SHA1
0e682c0c551cf023060d91a73a82f481c3d09466
-
SHA256
4de8206e7cfb664adf9b2563b6684e391a04eb212ba80009c96846e7eddea2b7
-
SHA512
5520705e0e5989f39f0b981e931b73a1c9d00feb5955b292474a5ffc8d9cb916a4ebc6a4258556aafab67da99124bbf8ea83b2f082bca329f37b8301917fd606
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1H6I+D:d7Tc9Wj16A3Stvx6I+D
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2456-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-668-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-701-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-726-0x0000000000320000-0x0000000000349000-memory.dmp family_blackmoon behavioral1/memory/1472-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-784-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-599-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-415-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2932-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/644-290-0x0000000077A60000-0x0000000077B7F000-memory.dmp family_blackmoon behavioral1/memory/548-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/400-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 3djdd.exe 2180 rrrxrxf.exe 2712 tbbtht.exe 2836 ttthbt.exe 3008 ffflfxx.exe 2992 hbhnbb.exe 2796 dpdpd.exe 2632 dddpj.exe 2232 lfflfrl.exe 948 tnhhbb.exe 1992 9jdpj.exe 1972 tnhhnt.exe 748 vdjvj.exe 2852 xllxrxr.exe 1168 3hthnb.exe 2760 djjvj.exe 3068 frrlfrf.exe 2308 hbtthh.exe 1512 jpdpp.exe 1452 lfffxfr.exe 1064 pjvvj.exe 1240 jddjd.exe 2476 btbthb.exe 2532 dppjd.exe 1716 xfrfxlf.exe 1532 hntntb.exe 692 dddpd.exe 548 9rrfxlf.exe 320 hhhtnt.exe 2036 dpdjj.exe 868 llrxrxx.exe 644 hhntth.exe 1588 9rxllxf.exe 2700 tnhhht.exe 2804 ttbnnt.exe 2832 jpjdj.exe 2592 7ntnht.exe 1976 pjvvd.exe 2792 9ffxxrl.exe 2816 lxffrll.exe 2704 ddddv.exe 2880 rflxrxr.exe 2336 ffflrxf.exe 2824 bntnnb.exe 1992 ppdpj.exe 952 xrrfrfr.exe 2828 tttbnt.exe 2848 ntntbh.exe 2932 pppvj.exe 2864 rxrlfxl.exe 2904 lrxfflf.exe 2260 bttbht.exe 1260 jjdpj.exe 3040 vvvjp.exe 3028 rfxlxfl.exe 2120 xflxfrr.exe 2076 nttnbn.exe 2156 jjpjp.exe 984 djddv.exe 1824 lrrxxrl.exe 2400 nnthbt.exe 2068 bnnbth.exe 2540 djpjj.exe 2092 xlxlrrl.exe -
resource yara_rule behavioral1/memory/2456-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-453-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-668-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-681-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-701-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-733-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-770-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-777-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-785-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-836-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-890-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-909-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-1107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-1222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-1278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-1398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-1367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-1354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-1335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-1310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-1297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-1173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-1123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-1114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-979-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-954-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-923-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-876-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-843-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-792-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-784-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-694-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-661-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-599-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-568-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-555-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-290-0x0000000077A60000-0x0000000077B7F000-memory.dmp upx behavioral1/memory/548-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-77-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 400 wrote to memory of 2456 400 050204638c21d977042b278a848759b7_JaffaCakes118.exe 1167 PID 400 wrote to memory of 2456 400 050204638c21d977042b278a848759b7_JaffaCakes118.exe 1167 PID 400 wrote to memory of 2456 400 050204638c21d977042b278a848759b7_JaffaCakes118.exe 1167 PID 400 wrote to memory of 2456 400 050204638c21d977042b278a848759b7_JaffaCakes118.exe 1167 PID 2456 wrote to memory of 2180 2456 3djdd.exe 31 PID 2456 wrote to memory of 2180 2456 3djdd.exe 31 PID 2456 wrote to memory of 2180 2456 3djdd.exe 31 PID 2456 wrote to memory of 2180 2456 3djdd.exe 31 PID 2180 wrote to memory of 2712 2180 rrrxrxf.exe 32 PID 2180 wrote to memory of 2712 2180 rrrxrxf.exe 32 PID 2180 wrote to memory of 2712 2180 rrrxrxf.exe 32 PID 2180 wrote to memory of 2712 2180 rrrxrxf.exe 32 PID 2712 wrote to memory of 2836 2712 tbbtht.exe 587 PID 2712 wrote to memory of 2836 2712 tbbtht.exe 587 PID 2712 wrote to memory of 2836 2712 tbbtht.exe 587 PID 2712 wrote to memory of 2836 2712 tbbtht.exe 587 PID 2836 wrote to memory of 3008 2836 ttthbt.exe 34 PID 2836 wrote to memory of 3008 2836 ttthbt.exe 34 PID 2836 wrote to memory of 3008 2836 ttthbt.exe 34 PID 2836 wrote to memory of 3008 2836 ttthbt.exe 34 PID 3008 wrote to memory of 2992 3008 ffflfxx.exe 35 PID 3008 wrote to memory of 2992 3008 ffflfxx.exe 35 PID 3008 wrote to memory of 2992 3008 ffflfxx.exe 35 PID 3008 wrote to memory of 2992 3008 ffflfxx.exe 35 PID 2992 wrote to memory of 2796 2992 hbhnbb.exe 36 PID 2992 wrote to memory of 2796 2992 hbhnbb.exe 36 PID 2992 wrote to memory of 2796 2992 hbhnbb.exe 36 PID 2992 wrote to memory of 2796 2992 hbhnbb.exe 36 PID 2796 wrote to memory of 2632 2796 dpdpd.exe 37 PID 2796 wrote to memory of 2632 2796 dpdpd.exe 37 PID 2796 wrote to memory of 2632 2796 dpdpd.exe 37 PID 2796 wrote to memory of 2632 2796 dpdpd.exe 37 PID 2632 wrote to memory of 2232 2632 dddpj.exe 38 PID 2632 wrote to memory of 2232 2632 dddpj.exe 38 PID 2632 wrote to memory of 2232 2632 dddpj.exe 38 PID 2632 wrote to memory of 2232 2632 dddpj.exe 38 PID 2232 wrote to memory of 948 2232 lfflfrl.exe 39 PID 2232 wrote to memory of 948 2232 lfflfrl.exe 39 PID 2232 wrote to memory of 948 2232 lfflfrl.exe 39 PID 2232 wrote to memory of 948 2232 lfflfrl.exe 39 PID 948 wrote to memory of 1992 948 tnhhbb.exe 75 PID 948 wrote to memory of 1992 948 tnhhbb.exe 75 PID 948 wrote to memory of 1992 948 tnhhbb.exe 75 PID 948 wrote to memory of 1992 948 tnhhbb.exe 75 PID 1992 wrote to memory of 1972 1992 9jdpj.exe 41 PID 1992 wrote to memory of 1972 1992 9jdpj.exe 41 PID 1992 wrote to memory of 1972 1992 9jdpj.exe 41 PID 1992 wrote to memory of 1972 1992 9jdpj.exe 41 PID 1972 wrote to memory of 748 1972 tnhhnt.exe 1140 PID 1972 wrote to memory of 748 1972 tnhhnt.exe 1140 PID 1972 wrote to memory of 748 1972 tnhhnt.exe 1140 PID 1972 wrote to memory of 748 1972 tnhhnt.exe 1140 PID 748 wrote to memory of 2852 748 vdjvj.exe 1553 PID 748 wrote to memory of 2852 748 vdjvj.exe 1553 PID 748 wrote to memory of 2852 748 vdjvj.exe 1553 PID 748 wrote to memory of 2852 748 vdjvj.exe 1553 PID 2852 wrote to memory of 1168 2852 xllxrxr.exe 44 PID 2852 wrote to memory of 1168 2852 xllxrxr.exe 44 PID 2852 wrote to memory of 1168 2852 xllxrxr.exe 44 PID 2852 wrote to memory of 1168 2852 xllxrxr.exe 44 PID 1168 wrote to memory of 2760 1168 3hthnb.exe 45 PID 1168 wrote to memory of 2760 1168 3hthnb.exe 45 PID 1168 wrote to memory of 2760 1168 3hthnb.exe 45 PID 1168 wrote to memory of 2760 1168 3hthnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\050204638c21d977042b278a848759b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\050204638c21d977042b278a848759b7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\3djdd.exec:\3djdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rrrxrxf.exec:\rrrxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\tbbtht.exec:\tbbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ttthbt.exec:\ttthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ffflfxx.exec:\ffflfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hbhnbb.exec:\hbhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dpdpd.exec:\dpdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dddpj.exec:\dddpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lfflfrl.exec:\lfflfrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\tnhhbb.exec:\tnhhbb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\9jdpj.exec:\9jdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\tnhhnt.exec:\tnhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vdjvj.exec:\vdjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\xllxrxr.exec:\xllxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3hthnb.exec:\3hthnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\djjvj.exec:\djjvj.exe17⤵
- Executes dropped EXE
PID:2760 -
\??\c:\frrlfrf.exec:\frrlfrf.exe18⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbtthh.exec:\hbtthh.exe19⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jpdpp.exec:\jpdpp.exe20⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lfffxfr.exec:\lfffxfr.exe21⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pjvvj.exec:\pjvvj.exe22⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jddjd.exec:\jddjd.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\btbthb.exec:\btbthb.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dppjd.exec:\dppjd.exe25⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hntntb.exec:\hntntb.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dddpd.exec:\dddpd.exe28⤵
- Executes dropped EXE
PID:692 -
\??\c:\9rrfxlf.exec:\9rrfxlf.exe29⤵
- Executes dropped EXE
PID:548 -
\??\c:\hhhtnt.exec:\hhhtnt.exe30⤵
- Executes dropped EXE
PID:320 -
\??\c:\dpdjj.exec:\dpdjj.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llrxrxx.exec:\llrxrxx.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\hhntth.exec:\hhntth.exe33⤵
- Executes dropped EXE
PID:644 -
\??\c:\7jdpj.exec:\7jdpj.exe34⤵PID:1268
-
\??\c:\9rxllxf.exec:\9rxllxf.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnhhht.exec:\tnhhht.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ttbnnt.exec:\ttbnnt.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jpjdj.exec:\jpjdj.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7ntnht.exec:\7ntnht.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjvvd.exec:\pjvvd.exe40⤵
- Executes dropped EXE
PID:1976 -
\??\c:\9ffxxrl.exec:\9ffxxrl.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lxffrll.exec:\lxffrll.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ddddv.exec:\ddddv.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rflxrxr.exec:\rflxrxr.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ffflrxf.exec:\ffflrxf.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bntnnb.exec:\bntnnb.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppdpj.exec:\ppdpj.exe47⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe48⤵
- Executes dropped EXE
PID:952 -
\??\c:\tttbnt.exec:\tttbnt.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ntntbh.exec:\ntntbh.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pppvj.exec:\pppvj.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rxrlfxl.exec:\rxrlfxl.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lrxfflf.exec:\lrxfflf.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bttbht.exec:\bttbht.exe54⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjdpj.exec:\jjdpj.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vvvjp.exec:\vvvjp.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rfxlxfl.exec:\rfxlxfl.exe57⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xflxfrr.exec:\xflxfrr.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nttnbn.exec:\nttnbn.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jjpjp.exec:\jjpjp.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\djddv.exec:\djddv.exe61⤵
- Executes dropped EXE
PID:984 -
\??\c:\lrrxxrl.exec:\lrrxxrl.exe62⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nnthbt.exec:\nnthbt.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bnnbth.exec:\bnnbth.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\djpjj.exec:\djpjj.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xlxlrrl.exec:\xlxlrrl.exe66⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbbnnh.exec:\nbbnnh.exe67⤵PID:2100
-
\??\c:\hhbtbb.exec:\hhbtbb.exe68⤵PID:2228
-
\??\c:\1dpdv.exec:\1dpdv.exe69⤵PID:320
-
\??\c:\flfrfxx.exec:\flfrfxx.exe70⤵PID:1696
-
\??\c:\tbtthn.exec:\tbtthn.exe71⤵PID:688
-
\??\c:\ttbbth.exec:\ttbbth.exe72⤵PID:2356
-
\??\c:\jpdpp.exec:\jpdpp.exe73⤵PID:272
-
\??\c:\1fxflxr.exec:\1fxflxr.exe74⤵PID:1592
-
\??\c:\lrllxxr.exec:\lrllxxr.exe75⤵PID:1632
-
\??\c:\htbnth.exec:\htbnth.exe76⤵PID:3048
-
\??\c:\vvdpp.exec:\vvdpp.exe77⤵PID:2812
-
\??\c:\5jjvj.exec:\5jjvj.exe78⤵PID:1928
-
\??\c:\lxxlrrf.exec:\lxxlrrf.exe79⤵PID:2572
-
\??\c:\nnttbh.exec:\nnttbh.exe80⤵PID:2620
-
\??\c:\hbtnht.exec:\hbtnht.exe81⤵PID:2032
-
\??\c:\dpppj.exec:\dpppj.exe82⤵PID:2528
-
\??\c:\9vpdd.exec:\9vpdd.exe83⤵PID:1760
-
\??\c:\9llxrfx.exec:\9llxrfx.exe84⤵PID:2976
-
\??\c:\nnhnbh.exec:\nnhnbh.exe85⤵PID:2096
-
\??\c:\jjdjv.exec:\jjdjv.exe86⤵PID:1324
-
\??\c:\fffrlfx.exec:\fffrlfx.exe87⤵PID:604
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe88⤵PID:2496
-
\??\c:\ttntth.exec:\ttntth.exe89⤵PID:2876
-
\??\c:\nbthtt.exec:\nbthtt.exe90⤵PID:1060
-
\??\c:\vvpvj.exec:\vvpvj.exe91⤵PID:2956
-
\??\c:\ffxfxlx.exec:\ffxfxlx.exe92⤵PID:2896
-
\??\c:\ttttht.exec:\ttttht.exe93⤵PID:2932
-
\??\c:\5thbtb.exec:\5thbtb.exe94⤵PID:408
-
\??\c:\jpppv.exec:\jpppv.exe95⤵PID:2924
-
\??\c:\pvjvj.exec:\pvjvj.exe96⤵PID:2308
-
\??\c:\xxllxlf.exec:\xxllxlf.exe97⤵PID:1512
-
\??\c:\tttbnn.exec:\tttbnn.exe98⤵PID:1668
-
\??\c:\tntnnn.exec:\tntnnn.exe99⤵PID:1028
-
\??\c:\5dpdv.exec:\5dpdv.exe100⤵PID:2764
-
\??\c:\jdpjj.exec:\jdpjj.exe101⤵PID:1240
-
\??\c:\3fxrrxl.exec:\3fxrrxl.exe102⤵PID:1788
-
\??\c:\ntthbh.exec:\ntthbh.exe103⤵
- System Location Discovery: System Language Discovery
PID:1776 -
\??\c:\djvpj.exec:\djvpj.exe104⤵PID:536
-
\??\c:\rrrllxl.exec:\rrrllxl.exe105⤵PID:2648
-
\??\c:\hbnnnt.exec:\hbnnnt.exe106⤵PID:992
-
\??\c:\5dvpd.exec:\5dvpd.exe107⤵PID:880
-
\??\c:\5vjvj.exec:\5vjvj.exe108⤵PID:2092
-
\??\c:\7fxflxl.exec:\7fxflxl.exe109⤵PID:1624
-
\??\c:\7tntnn.exec:\7tntnn.exe110⤵PID:1472
-
\??\c:\hnbnbt.exec:\hnbnbt.exe111⤵PID:2284
-
\??\c:\5vddd.exec:\5vddd.exe112⤵PID:2280
-
\??\c:\lfflxll.exec:\lfflxll.exe113⤵PID:1008
-
\??\c:\5nnbhh.exec:\5nnbhh.exe114⤵PID:2752
-
\??\c:\bbbhth.exec:\bbbhth.exe115⤵PID:2180
-
\??\c:\djpvp.exec:\djpvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe117⤵PID:2856
-
\??\c:\ffrxxll.exec:\ffrxxll.exe118⤵PID:2832
-
\??\c:\thhnht.exec:\thhnht.exe119⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\jpvjd.exec:\jpvjd.exe120⤵PID:2808
-
\??\c:\1jjjv.exec:\1jjjv.exe121⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-