Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
050204638c21d977042b278a848759b7_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
050204638c21d977042b278a848759b7_JaffaCakes118.exe
-
Size
459KB
-
MD5
050204638c21d977042b278a848759b7
-
SHA1
0e682c0c551cf023060d91a73a82f481c3d09466
-
SHA256
4de8206e7cfb664adf9b2563b6684e391a04eb212ba80009c96846e7eddea2b7
-
SHA512
5520705e0e5989f39f0b981e931b73a1c9d00feb5955b292474a5ffc8d9cb916a4ebc6a4258556aafab67da99124bbf8ea83b2f082bca329f37b8301917fd606
-
SSDEEP
6144:Pcm7ImGddXtWrXD486jJq1BStv4Ib1H6I+D:d7Tc9Wj16A3Stvx6I+D
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4884-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-505-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-544-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-603-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-626-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-657-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-825-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-1001-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4888 nhhbtt.exe 5036 dvdvp.exe 3136 hthbtb.exe 1548 1jvdv.exe 4752 ntbtnt.exe 1616 3rlfrxr.exe 3784 ttbtbb.exe 1976 jjpjj.exe 4872 3tbtbb.exe 3088 dvdjd.exe 4308 lllfffx.exe 2256 llxfxxr.exe 5020 nnbbbh.exe 772 fxfxrlf.exe 3444 5djjp.exe 3480 3llfffl.exe 4112 ppvpj.exe 4924 xfxrllf.exe 4436 vjdvj.exe 2304 hnnhbb.exe 4756 hhttbb.exe 3848 pjpjj.exe 3560 9nnnhn.exe 2760 jpvpp.exe 3408 5fxxrxr.exe 316 ntbtnn.exe 2228 3djjp.exe 1348 rflllxx.exe 3148 vvdvv.exe 3912 flrrllr.exe 4764 1hnbhh.exe 224 1djdv.exe 4304 nnbtnn.exe 2516 jjddv.exe 2424 rlxrlfr.exe 5040 rxrlrff.exe 4364 pjjdv.exe 3312 vjppj.exe 3068 flfxllf.exe 3616 thhnhb.exe 3528 pddvp.exe 1636 rrlfxrr.exe 2608 nbnbnb.exe 4144 vjpdj.exe 3420 vjpjv.exe 4316 rllfxrl.exe 1652 7hhtbn.exe 1820 vddpv.exe 1840 xxxlfxf.exe 2024 tbhtnh.exe 4648 jddpj.exe 3944 vpppj.exe 1488 lxrlflx.exe 3100 5nhbtn.exe 2908 pjjdd.exe 4300 llrlfxl.exe 796 bbbnbt.exe 540 vpppp.exe 4980 frxxxxx.exe 4224 tbtbth.exe 2304 hhtnht.exe 4156 jddvv.exe 3980 lrxxrxx.exe 3612 1bttnn.exe -
resource yara_rule behavioral2/memory/4884-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-412-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-431-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-435-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-494-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4888 4884 050204638c21d977042b278a848759b7_JaffaCakes118.exe 84 PID 4884 wrote to memory of 4888 4884 050204638c21d977042b278a848759b7_JaffaCakes118.exe 84 PID 4884 wrote to memory of 4888 4884 050204638c21d977042b278a848759b7_JaffaCakes118.exe 84 PID 4888 wrote to memory of 5036 4888 nhhbtt.exe 85 PID 4888 wrote to memory of 5036 4888 nhhbtt.exe 85 PID 4888 wrote to memory of 5036 4888 nhhbtt.exe 85 PID 5036 wrote to memory of 3136 5036 dvdvp.exe 86 PID 5036 wrote to memory of 3136 5036 dvdvp.exe 86 PID 5036 wrote to memory of 3136 5036 dvdvp.exe 86 PID 3136 wrote to memory of 1548 3136 hthbtb.exe 87 PID 3136 wrote to memory of 1548 3136 hthbtb.exe 87 PID 3136 wrote to memory of 1548 3136 hthbtb.exe 87 PID 1548 wrote to memory of 4752 1548 1jvdv.exe 88 PID 1548 wrote to memory of 4752 1548 1jvdv.exe 88 PID 1548 wrote to memory of 4752 1548 1jvdv.exe 88 PID 4752 wrote to memory of 1616 4752 ntbtnt.exe 89 PID 4752 wrote to memory of 1616 4752 ntbtnt.exe 89 PID 4752 wrote to memory of 1616 4752 ntbtnt.exe 89 PID 1616 wrote to memory of 3784 1616 3rlfrxr.exe 90 PID 1616 wrote to memory of 3784 1616 3rlfrxr.exe 90 PID 1616 wrote to memory of 3784 1616 3rlfrxr.exe 90 PID 3784 wrote to memory of 1976 3784 ttbtbb.exe 91 PID 3784 wrote to memory of 1976 3784 ttbtbb.exe 91 PID 3784 wrote to memory of 1976 3784 ttbtbb.exe 91 PID 1976 wrote to memory of 4872 1976 jjpjj.exe 92 PID 1976 wrote to memory of 4872 1976 jjpjj.exe 92 PID 1976 wrote to memory of 4872 1976 jjpjj.exe 92 PID 4872 wrote to memory of 3088 4872 3tbtbb.exe 93 PID 4872 wrote to memory of 3088 4872 3tbtbb.exe 93 PID 4872 wrote to memory of 3088 4872 3tbtbb.exe 93 PID 3088 wrote to memory of 4308 3088 dvdjd.exe 94 PID 3088 wrote to memory of 4308 3088 dvdjd.exe 94 PID 3088 wrote to memory of 4308 3088 dvdjd.exe 94 PID 4308 wrote to memory of 2256 4308 lllfffx.exe 95 PID 4308 wrote to memory of 2256 4308 lllfffx.exe 95 PID 4308 wrote to memory of 2256 4308 lllfffx.exe 95 PID 2256 wrote to memory of 5020 2256 llxfxxr.exe 96 PID 2256 wrote to memory of 5020 2256 llxfxxr.exe 96 PID 2256 wrote to memory of 5020 2256 llxfxxr.exe 96 PID 5020 wrote to memory of 772 5020 nnbbbh.exe 97 PID 5020 wrote to memory of 772 5020 nnbbbh.exe 97 PID 5020 wrote to memory of 772 5020 nnbbbh.exe 97 PID 772 wrote to memory of 3444 772 fxfxrlf.exe 98 PID 772 wrote to memory of 3444 772 fxfxrlf.exe 98 PID 772 wrote to memory of 3444 772 fxfxrlf.exe 98 PID 3444 wrote to memory of 3480 3444 5djjp.exe 99 PID 3444 wrote to memory of 3480 3444 5djjp.exe 99 PID 3444 wrote to memory of 3480 3444 5djjp.exe 99 PID 3480 wrote to memory of 4112 3480 3llfffl.exe 100 PID 3480 wrote to memory of 4112 3480 3llfffl.exe 100 PID 3480 wrote to memory of 4112 3480 3llfffl.exe 100 PID 4112 wrote to memory of 4924 4112 ppvpj.exe 102 PID 4112 wrote to memory of 4924 4112 ppvpj.exe 102 PID 4112 wrote to memory of 4924 4112 ppvpj.exe 102 PID 4924 wrote to memory of 4436 4924 xfxrllf.exe 104 PID 4924 wrote to memory of 4436 4924 xfxrllf.exe 104 PID 4924 wrote to memory of 4436 4924 xfxrllf.exe 104 PID 4436 wrote to memory of 2304 4436 vjdvj.exe 105 PID 4436 wrote to memory of 2304 4436 vjdvj.exe 105 PID 4436 wrote to memory of 2304 4436 vjdvj.exe 105 PID 2304 wrote to memory of 4756 2304 hnnhbb.exe 106 PID 2304 wrote to memory of 4756 2304 hnnhbb.exe 106 PID 2304 wrote to memory of 4756 2304 hnnhbb.exe 106 PID 4756 wrote to memory of 3848 4756 hhttbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\050204638c21d977042b278a848759b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\050204638c21d977042b278a848759b7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\nhhbtt.exec:\nhhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\dvdvp.exec:\dvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\hthbtb.exec:\hthbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\1jvdv.exec:\1jvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\ntbtnt.exec:\ntbtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\3rlfrxr.exec:\3rlfrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\ttbtbb.exec:\ttbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\jjpjj.exec:\jjpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3tbtbb.exec:\3tbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\dvdjd.exec:\dvdjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\lllfffx.exec:\lllfffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\llxfxxr.exec:\llxfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nnbbbh.exec:\nnbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\5djjp.exec:\5djjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\3llfffl.exec:\3llfffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\xfxrllf.exec:\xfxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vjdvj.exec:\vjdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\hnnhbb.exec:\hnnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\hhttbb.exec:\hhttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\pjpjj.exec:\pjpjj.exe23⤵
- Executes dropped EXE
PID:3848 -
\??\c:\9nnnhn.exec:\9nnnhn.exe24⤵
- Executes dropped EXE
PID:3560 -
\??\c:\jpvpp.exec:\jpvpp.exe25⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5fxxrxr.exec:\5fxxrxr.exe26⤵
- Executes dropped EXE
PID:3408 -
\??\c:\ntbtnn.exec:\ntbtnn.exe27⤵
- Executes dropped EXE
PID:316 -
\??\c:\3djjp.exec:\3djjp.exe28⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rflllxx.exec:\rflllxx.exe29⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vvdvv.exec:\vvdvv.exe30⤵
- Executes dropped EXE
PID:3148 -
\??\c:\flrrllr.exec:\flrrllr.exe31⤵
- Executes dropped EXE
PID:3912 -
\??\c:\1hnbhh.exec:\1hnbhh.exe32⤵
- Executes dropped EXE
PID:4764 -
\??\c:\1djdv.exec:\1djdv.exe33⤵
- Executes dropped EXE
PID:224 -
\??\c:\nnbtnn.exec:\nnbtnn.exe34⤵
- Executes dropped EXE
PID:4304 -
\??\c:\jjddv.exec:\jjddv.exe35⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rlxrlfr.exec:\rlxrlfr.exe36⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rxrlrff.exec:\rxrlrff.exe37⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:4364 -
\??\c:\vjppj.exec:\vjppj.exe39⤵
- Executes dropped EXE
PID:3312 -
\??\c:\flfxllf.exec:\flfxllf.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\thhnhb.exec:\thhnhb.exe41⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pddvp.exec:\pddvp.exe42⤵
- Executes dropped EXE
PID:3528 -
\??\c:\rrlfxrr.exec:\rrlfxrr.exe43⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nbnbnb.exec:\nbnbnb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\vjpdj.exec:\vjpdj.exe45⤵
- Executes dropped EXE
PID:4144 -
\??\c:\vjpjv.exec:\vjpjv.exe46⤵
- Executes dropped EXE
PID:3420 -
\??\c:\rllfxrl.exec:\rllfxrl.exe47⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7hhtbn.exec:\7hhtbn.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vddpv.exec:\vddpv.exe49⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xxxlfxf.exec:\xxxlfxf.exe50⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tbhtnh.exec:\tbhtnh.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jddpj.exec:\jddpj.exe52⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vpppj.exec:\vpppj.exe53⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lxrlflx.exec:\lxrlflx.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5nhbtn.exec:\5nhbtn.exe55⤵
- Executes dropped EXE
PID:3100 -
\??\c:\pjjdd.exec:\pjjdd.exe56⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llrlfxl.exec:\llrlfxl.exe57⤵
- Executes dropped EXE
PID:4300 -
\??\c:\bbbnbt.exec:\bbbnbt.exe58⤵
- Executes dropped EXE
PID:796 -
\??\c:\vpppp.exec:\vpppp.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\frxxxxx.exec:\frxxxxx.exe60⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tbtbth.exec:\tbtbth.exe61⤵
- Executes dropped EXE
PID:4224 -
\??\c:\hhtnht.exec:\hhtnht.exe62⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jddvv.exec:\jddvv.exe63⤵
- Executes dropped EXE
PID:4156 -
\??\c:\lrxxrxx.exec:\lrxxrxx.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\1bttnn.exec:\1bttnn.exe65⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jjjjd.exec:\jjjjd.exe66⤵PID:2112
-
\??\c:\jpvpp.exec:\jpvpp.exe67⤵PID:4692
-
\??\c:\rrllfff.exec:\rrllfff.exe68⤵PID:4492
-
\??\c:\nhttbb.exec:\nhttbb.exe69⤵PID:456
-
\??\c:\hbbtnt.exec:\hbbtnt.exe70⤵PID:2460
-
\??\c:\pjjpj.exec:\pjjpj.exe71⤵PID:3408
-
\??\c:\xrxxrll.exec:\xrxxrll.exe72⤵PID:2612
-
\??\c:\thtnhb.exec:\thtnhb.exe73⤵PID:1752
-
\??\c:\nbhhbb.exec:\nbhhbb.exe74⤵PID:1272
-
\??\c:\pddjd.exec:\pddjd.exe75⤵PID:2544
-
\??\c:\lrrfrfr.exec:\lrrfrfr.exe76⤵PID:4684
-
\??\c:\bthtnb.exec:\bthtnb.exe77⤵PID:3328
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe78⤵PID:2192
-
\??\c:\nttnhb.exec:\nttnhb.exe79⤵PID:4212
-
\??\c:\ttnhbb.exec:\ttnhbb.exe80⤵PID:4324
-
\??\c:\jjvjd.exec:\jjvjd.exe81⤵PID:4292
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe82⤵PID:2476
-
\??\c:\tthbhh.exec:\tthbhh.exe83⤵PID:4416
-
\??\c:\5hntnb.exec:\5hntnb.exe84⤵PID:3648
-
\??\c:\pjdpv.exec:\pjdpv.exe85⤵PID:5036
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe86⤵PID:4312
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe87⤵PID:2836
-
\??\c:\ttnnhb.exec:\ttnnhb.exe88⤵PID:3136
-
\??\c:\7vjpv.exec:\7vjpv.exe89⤵PID:3824
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe90⤵PID:3632
-
\??\c:\hhtnhb.exec:\hhtnhb.exe91⤵PID:4468
-
\??\c:\nhhtnn.exec:\nhhtnn.exe92⤵PID:2984
-
\??\c:\jvddj.exec:\jvddj.exe93⤵PID:2608
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe94⤵PID:4656
-
\??\c:\tbbnht.exec:\tbbnht.exe95⤵PID:3088
-
\??\c:\9jpjd.exec:\9jpjd.exe96⤵PID:4316
-
\??\c:\frlfxrl.exec:\frlfxrl.exe97⤵PID:1596
-
\??\c:\nbbnhb.exec:\nbbnhb.exe98⤵PID:3124
-
\??\c:\vpjpd.exec:\vpjpd.exe99⤵PID:5020
-
\??\c:\vvvvp.exec:\vvvvp.exe100⤵PID:312
-
\??\c:\fxllffx.exec:\fxllffx.exe101⤵PID:3572
-
\??\c:\9ntnhb.exec:\9ntnhb.exe102⤵PID:4200
-
\??\c:\pvvpj.exec:\pvvpj.exe103⤵PID:3444
-
\??\c:\vjpdj.exec:\vjpdj.exe104⤵PID:2172
-
\??\c:\9llfxrl.exec:\9llfxrl.exe105⤵PID:2860
-
\??\c:\5thhbb.exec:\5thhbb.exe106⤵PID:3820
-
\??\c:\9ddvp.exec:\9ddvp.exe107⤵PID:2708
-
\??\c:\jdjjd.exec:\jdjjd.exe108⤵PID:5048
-
\??\c:\llflrrf.exec:\llflrrf.exe109⤵PID:2660
-
\??\c:\1tbttb.exec:\1tbttb.exe110⤵PID:4980
-
\??\c:\djvpv.exec:\djvpv.exe111⤵PID:4224
-
\??\c:\rrxlfrl.exec:\rrxlfrl.exe112⤵PID:2064
-
\??\c:\htbtnn.exec:\htbtnn.exe113⤵PID:3876
-
\??\c:\3vdvp.exec:\3vdvp.exe114⤵PID:2240
-
\??\c:\lxrrfrl.exec:\lxrrfrl.exe115⤵PID:3352
-
\??\c:\9ttnnb.exec:\9ttnnb.exe116⤵PID:2912
-
\??\c:\jppjj.exec:\jppjj.exe117⤵PID:3612
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe118⤵PID:2924
-
\??\c:\rlflxlr.exec:\rlflxlr.exe119⤵PID:3144
-
\??\c:\bbbtnh.exec:\bbbtnh.exe120⤵PID:4348
-
\??\c:\pjpjv.exec:\pjpjv.exe121⤵PID:1556
-
\??\c:\rfllfxr.exec:\rfllfxr.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-