Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe
-
Size
89KB
-
MD5
056c1886355c4e5d394af32cfc9b243a
-
SHA1
dc3e69b6907927ddf08653e01d0d5978e477dee1
-
SHA256
ccc3954dbdc991134eb8f352687f15f74fd088ebfa7050fe4abbca5fccdce009
-
SHA512
338d30d722ba67a8a30e25593e77bcec02bf9602fa50a34643b817c73e03e5bf06e7e4c3ddf39f9a9b8390c91cf7ad74e46ad9f88271aef29c72598e3c53c416
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfdK4M:ymb3NkkiQ3mdBjFo73PYP1lri3KuOlK7
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4420-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-44-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3180 lrlfxxr.exe 1508 7tnnhh.exe 3952 vjddj.exe 660 rrffxlr.exe 2344 tnnhtt.exe 2480 nbttnt.exe 2624 dvpjp.exe 4844 vpddd.exe 4900 tttnnh.exe 4568 bbhhtb.exe 4324 vjppj.exe 1552 9llfxxr.exe 4052 ttbtbh.exe 1664 tnthnb.exe 724 vdjjj.exe 1252 fffrlxx.exe 4140 nnnnnn.exe 2304 ppvjv.exe 2308 xxrllll.exe 4344 hbhhhh.exe 2800 tbhbhb.exe 2192 jvjvd.exe 1172 jvjdj.exe 2868 fxflrfl.exe 404 htbttt.exe 4932 pppjd.exe 3908 pjjjv.exe 4484 lllfxfx.exe 636 bnthbb.exe 676 lffxlrr.exe 5060 bbnbbh.exe 1876 nnhhhb.exe 5112 dvddv.exe 3768 fxfxxxr.exe 1176 bnhhbb.exe 4280 bthnnt.exe 1948 jjjdd.exe 2600 lxflfff.exe 1260 7fllxff.exe 4924 tthttt.exe 2036 ntthbh.exe 1220 1jvdv.exe 4804 dvvdv.exe 388 rlfxrxx.exe 2636 llfffll.exe 2472 hbtntt.exe 2040 bbbbth.exe 2104 pjppv.exe 2664 ppvpj.exe 4920 rrrrlll.exe 1520 bnhbbt.exe 2572 nhhhhn.exe 4488 djddd.exe 4072 ppvjd.exe 2220 xlfxlll.exe 4472 flfffff.exe 4604 nnnthn.exe 392 jddpj.exe 3580 rfrlfff.exe 4428 7xxrllf.exe 2444 thhntt.exe 1852 jpddd.exe 2532 djdpv.exe 2152 rffxrlf.exe -
resource yara_rule behavioral2/memory/4420-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 3180 4420 056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe 84 PID 4420 wrote to memory of 3180 4420 056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe 84 PID 4420 wrote to memory of 3180 4420 056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe 84 PID 3180 wrote to memory of 1508 3180 lrlfxxr.exe 85 PID 3180 wrote to memory of 1508 3180 lrlfxxr.exe 85 PID 3180 wrote to memory of 1508 3180 lrlfxxr.exe 85 PID 1508 wrote to memory of 3952 1508 7tnnhh.exe 86 PID 1508 wrote to memory of 3952 1508 7tnnhh.exe 86 PID 1508 wrote to memory of 3952 1508 7tnnhh.exe 86 PID 3952 wrote to memory of 660 3952 vjddj.exe 87 PID 3952 wrote to memory of 660 3952 vjddj.exe 87 PID 3952 wrote to memory of 660 3952 vjddj.exe 87 PID 660 wrote to memory of 2344 660 rrffxlr.exe 88 PID 660 wrote to memory of 2344 660 rrffxlr.exe 88 PID 660 wrote to memory of 2344 660 rrffxlr.exe 88 PID 2344 wrote to memory of 2480 2344 tnnhtt.exe 89 PID 2344 wrote to memory of 2480 2344 tnnhtt.exe 89 PID 2344 wrote to memory of 2480 2344 tnnhtt.exe 89 PID 2480 wrote to memory of 2624 2480 nbttnt.exe 90 PID 2480 wrote to memory of 2624 2480 nbttnt.exe 90 PID 2480 wrote to memory of 2624 2480 nbttnt.exe 90 PID 2624 wrote to memory of 4844 2624 dvpjp.exe 91 PID 2624 wrote to memory of 4844 2624 dvpjp.exe 91 PID 2624 wrote to memory of 4844 2624 dvpjp.exe 91 PID 4844 wrote to memory of 4900 4844 vpddd.exe 92 PID 4844 wrote to memory of 4900 4844 vpddd.exe 92 PID 4844 wrote to memory of 4900 4844 vpddd.exe 92 PID 4900 wrote to memory of 4568 4900 tttnnh.exe 93 PID 4900 wrote to memory of 4568 4900 tttnnh.exe 93 PID 4900 wrote to memory of 4568 4900 tttnnh.exe 93 PID 4568 wrote to memory of 4324 4568 bbhhtb.exe 94 PID 4568 wrote to memory of 4324 4568 bbhhtb.exe 94 PID 4568 wrote to memory of 4324 4568 bbhhtb.exe 94 PID 4324 wrote to memory of 1552 4324 vjppj.exe 95 PID 4324 wrote to memory of 1552 4324 vjppj.exe 95 PID 4324 wrote to memory of 1552 4324 vjppj.exe 95 PID 1552 wrote to memory of 4052 1552 9llfxxr.exe 96 PID 1552 wrote to memory of 4052 1552 9llfxxr.exe 96 PID 1552 wrote to memory of 4052 1552 9llfxxr.exe 96 PID 4052 wrote to memory of 1664 4052 ttbtbh.exe 97 PID 4052 wrote to memory of 1664 4052 ttbtbh.exe 97 PID 4052 wrote to memory of 1664 4052 ttbtbh.exe 97 PID 1664 wrote to memory of 724 1664 tnthnb.exe 98 PID 1664 wrote to memory of 724 1664 tnthnb.exe 98 PID 1664 wrote to memory of 724 1664 tnthnb.exe 98 PID 724 wrote to memory of 1252 724 vdjjj.exe 99 PID 724 wrote to memory of 1252 724 vdjjj.exe 99 PID 724 wrote to memory of 1252 724 vdjjj.exe 99 PID 1252 wrote to memory of 4140 1252 fffrlxx.exe 100 PID 1252 wrote to memory of 4140 1252 fffrlxx.exe 100 PID 1252 wrote to memory of 4140 1252 fffrlxx.exe 100 PID 4140 wrote to memory of 2304 4140 nnnnnn.exe 101 PID 4140 wrote to memory of 2304 4140 nnnnnn.exe 101 PID 4140 wrote to memory of 2304 4140 nnnnnn.exe 101 PID 2304 wrote to memory of 2308 2304 ppvjv.exe 102 PID 2304 wrote to memory of 2308 2304 ppvjv.exe 102 PID 2304 wrote to memory of 2308 2304 ppvjv.exe 102 PID 2308 wrote to memory of 4344 2308 xxrllll.exe 103 PID 2308 wrote to memory of 4344 2308 xxrllll.exe 103 PID 2308 wrote to memory of 4344 2308 xxrllll.exe 103 PID 4344 wrote to memory of 2800 4344 hbhhhh.exe 104 PID 4344 wrote to memory of 2800 4344 hbhhhh.exe 104 PID 4344 wrote to memory of 2800 4344 hbhhhh.exe 104 PID 2800 wrote to memory of 2192 2800 tbhbhb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056c1886355c4e5d394af32cfc9b243a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\7tnnhh.exec:\7tnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\vjddj.exec:\vjddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\rrffxlr.exec:\rrffxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\tnnhtt.exec:\tnnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nbttnt.exec:\nbttnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dvpjp.exec:\dvpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vpddd.exec:\vpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\tttnnh.exec:\tttnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\bbhhtb.exec:\bbhhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\9llfxxr.exec:\9llfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\ttbtbh.exec:\ttbtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\tnthnb.exec:\tnthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vdjjj.exec:\vdjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\fffrlxx.exec:\fffrlxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\nnnnnn.exec:\nnnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\ppvjv.exec:\ppvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xxrllll.exec:\xxrllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hbhhhh.exec:\hbhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\tbhbhb.exec:\tbhbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jvjvd.exec:\jvjvd.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jvjdj.exec:\jvjdj.exe24⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fxflrfl.exec:\fxflrfl.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\htbttt.exec:\htbttt.exe26⤵
- Executes dropped EXE
PID:404 -
\??\c:\pppjd.exec:\pppjd.exe27⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pjjjv.exec:\pjjjv.exe28⤵
- Executes dropped EXE
PID:3908 -
\??\c:\lllfxfx.exec:\lllfxfx.exe29⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bnthbb.exec:\bnthbb.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\lffxlrr.exec:\lffxlrr.exe31⤵
- Executes dropped EXE
PID:676 -
\??\c:\bbnbbh.exec:\bbnbbh.exe32⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nnhhhb.exec:\nnhhhb.exe33⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dvddv.exec:\dvddv.exe34⤵
- Executes dropped EXE
PID:5112 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe35⤵
- Executes dropped EXE
PID:3768 -
\??\c:\bnhhbb.exec:\bnhhbb.exe36⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bthnnt.exec:\bthnnt.exe37⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jjjdd.exec:\jjjdd.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lxflfff.exec:\lxflfff.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7fllxff.exec:\7fllxff.exe40⤵
- Executes dropped EXE
PID:1260 -
\??\c:\tthttt.exec:\tthttt.exe41⤵
- Executes dropped EXE
PID:4924 -
\??\c:\ntthbh.exec:\ntthbh.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1jvdv.exec:\1jvdv.exe43⤵
- Executes dropped EXE
PID:1220 -
\??\c:\dvvdv.exec:\dvvdv.exe44⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rlfxrxx.exec:\rlfxrxx.exe45⤵
- Executes dropped EXE
PID:388 -
\??\c:\llfffll.exec:\llfffll.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbtntt.exec:\hbtntt.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bbbbth.exec:\bbbbth.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pjppv.exec:\pjppv.exe49⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ppvpj.exec:\ppvpj.exe50⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrrrlll.exec:\rrrrlll.exe51⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bnhbbt.exec:\bnhbbt.exe52⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nhhhhn.exec:\nhhhhn.exe53⤵
- Executes dropped EXE
PID:2572 -
\??\c:\djddd.exec:\djddd.exe54⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ppvjd.exec:\ppvjd.exe55⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xlfxlll.exec:\xlfxlll.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flfffff.exec:\flfffff.exe57⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nnnthn.exec:\nnnthn.exe58⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jddpj.exec:\jddpj.exe59⤵
- Executes dropped EXE
PID:392 -
\??\c:\rfrlfff.exec:\rfrlfff.exe60⤵
- Executes dropped EXE
PID:3580 -
\??\c:\7xxrllf.exec:\7xxrllf.exe61⤵
- Executes dropped EXE
PID:4428 -
\??\c:\thhntt.exec:\thhntt.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jpddd.exec:\jpddd.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djdpv.exec:\djdpv.exe64⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rffxrlf.exec:\rffxrlf.exe65⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bhhhbb.exec:\bhhhbb.exe66⤵PID:4240
-
\??\c:\hnhnhn.exec:\hnhnhn.exe67⤵PID:1440
-
\??\c:\jjvdp.exec:\jjvdp.exe68⤵PID:2584
-
\??\c:\pdppj.exec:\pdppj.exe69⤵PID:3024
-
\??\c:\lrffflr.exec:\lrffflr.exe70⤵PID:4484
-
\??\c:\3tttnn.exec:\3tttnn.exe71⤵PID:4732
-
\??\c:\ppjdv.exec:\ppjdv.exe72⤵PID:4540
-
\??\c:\jppjv.exec:\jppjv.exe73⤵PID:4304
-
\??\c:\lrfrfxf.exec:\lrfrfxf.exe74⤵PID:4388
-
\??\c:\bnbttt.exec:\bnbttt.exe75⤵PID:4460
-
\??\c:\ttttbh.exec:\ttttbh.exe76⤵PID:1492
-
\??\c:\xfrrxlx.exec:\xfrrxlx.exe77⤵PID:4272
-
\??\c:\rrrfxff.exec:\rrrfxff.exe78⤵PID:2576
-
\??\c:\hthbtt.exec:\hthbtt.exe79⤵PID:4280
-
\??\c:\nnhnnt.exec:\nnhnnt.exe80⤵PID:1948
-
\??\c:\jpjjd.exec:\jpjjd.exe81⤵PID:1540
-
\??\c:\lrxlrrx.exec:\lrxlrrx.exe82⤵PID:1016
-
\??\c:\1tttnh.exec:\1tttnh.exe83⤵PID:4500
-
\??\c:\tntnnn.exec:\tntnnn.exe84⤵
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\dpjvp.exec:\dpjvp.exe85⤵PID:3612
-
\??\c:\vvjdj.exec:\vvjdj.exe86⤵PID:1528
-
\??\c:\7xxlffx.exec:\7xxlffx.exe87⤵PID:1796
-
\??\c:\rrxrfff.exec:\rrxrfff.exe88⤵PID:2916
-
\??\c:\7bhbhh.exec:\7bhbhh.exe89⤵PID:4324
-
\??\c:\hnnhtt.exec:\hnnhtt.exe90⤵PID:4764
-
\??\c:\dvdpj.exec:\dvdpj.exe91⤵PID:1552
-
\??\c:\7rxlfxr.exec:\7rxlfxr.exe92⤵PID:4808
-
\??\c:\lxxfxll.exec:\lxxfxll.exe93⤵PID:4920
-
\??\c:\htbttt.exec:\htbttt.exe94⤵PID:1372
-
\??\c:\7vjpp.exec:\7vjpp.exe95⤵PID:4532
-
\??\c:\vpvpd.exec:\vpvpd.exe96⤵PID:3940
-
\??\c:\rflrlll.exec:\rflrlll.exe97⤵PID:1252
-
\??\c:\7nthbt.exec:\7nthbt.exe98⤵PID:1988
-
\??\c:\9tnhbb.exec:\9tnhbb.exe99⤵PID:4512
-
\??\c:\vpvvp.exec:\vpvvp.exe100⤵PID:1008
-
\??\c:\vpjjd.exec:\vpjjd.exe101⤵PID:1360
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe102⤵PID:4184
-
\??\c:\ntnbnh.exec:\ntnbnh.exe103⤵PID:3956
-
\??\c:\bhhbnn.exec:\bhhbnn.exe104⤵PID:4428
-
\??\c:\pdvdp.exec:\pdvdp.exe105⤵PID:2376
-
\??\c:\jjvjd.exec:\jjvjd.exe106⤵PID:1396
-
\??\c:\rfrllll.exec:\rfrllll.exe107⤵PID:2900
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe108⤵PID:428
-
\??\c:\nbbbtn.exec:\nbbbtn.exe109⤵PID:3464
-
\??\c:\ntnbtn.exec:\ntnbtn.exe110⤵PID:3192
-
\??\c:\pvpdp.exec:\pvpdp.exe111⤵PID:3308
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe112⤵PID:3496
-
\??\c:\5hnbtt.exec:\5hnbtt.exe113⤵PID:3916
-
\??\c:\3nthbt.exec:\3nthbt.exe114⤵PID:3428
-
\??\c:\jjvjj.exec:\jjvjj.exe115⤵PID:4484
-
\??\c:\jpvpj.exec:\jpvpj.exe116⤵PID:4348
-
\??\c:\bnnbbb.exec:\bnnbbb.exe117⤵PID:2604
-
\??\c:\nnbthb.exec:\nnbthb.exe118⤵PID:3100
-
\??\c:\vjvpd.exec:\vjvpd.exe119⤵PID:4380
-
\??\c:\ppvdp.exec:\ppvdp.exe120⤵PID:828
-
\??\c:\xflfxxf.exec:\xflfxxf.exe121⤵PID:660
-
\??\c:\llxxrxx.exec:\llxxrxx.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-