Analysis
-
max time kernel
115s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28-07-2024 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe
-
Size
198KB
-
MD5
05821510f28e0481e6987d3e08557d28
-
SHA1
4a73a669efb67f99f4371fe673eada5ddf44fab7
-
SHA256
b9dba10b3d5fb684ca1aeaa00e14f209aeedaafedb87b61ce2080c885aca6334
-
SHA512
6fab4b00de042b2d8deb58be12fc80757336aba09d7150b61f1be11e0f623f8b37e43567212077aad629bf438024c3ff800c233fc1e6c8d51d75c6275e1aebe8
-
SSDEEP
1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYsU58fnZ:EhOm2sI93UufdC67ciyt3ujFf7jafnZ
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1316-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-235-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1780-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-267-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2828-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-331-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-359-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2612-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-397-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2700-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-449-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1620-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-726-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1628-835-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-1003-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 752 pvpdd.exe 2072 rxxllfl.exe 2812 pvvdj.exe 2992 tntbbh.exe 2252 jdvdp.exe 2952 xlrllrx.exe 2740 tttbnn.exe 2620 vdvpj.exe 2084 fflxrlr.exe 2544 nhbhbh.exe 2692 5rrflfx.exe 2132 1tthnn.exe 2580 lrrllxr.exe 2376 9tthbt.exe 2588 1jppp.exe 3048 rfxlflx.exe 2788 nbbtnb.exe 2332 frxrfxx.exe 484 3nbbtb.exe 2360 llrfffx.exe 956 9hbbbh.exe 2380 lxlfllr.exe 916 1btbnh.exe 984 pjdvj.exe 1780 llfllxx.exe 3028 5nnnbh.exe 2488 rrxrlxr.exe 824 5ttnbh.exe 3040 rflxfrx.exe 1788 lfrlxfr.exe 304 dvpdp.exe 2456 vvvpd.exe 2248 htbbnh.exe 1608 nbhtbn.exe 2696 3jvjd.exe 2828 llllllx.exe 2888 tnhtth.exe 2708 bbbnbb.exe 2108 7pvvp.exe 2864 flllxll.exe 2716 bbbhtb.exe 2612 hbbhtt.exe 2616 vdvjv.exe 2084 xxxxrfl.exe 2532 ttthhb.exe 2544 7djvd.exe 2700 9xrxrrf.exe 3016 bhnbbn.exe 3008 pppdv.exe 2144 xxfrxfr.exe 2848 rlfrlxl.exe 2964 htbhhh.exe 2344 pdvjd.exe 2520 fxxxrxl.exe 2336 ttbbht.exe 2116 jddpd.exe 1620 5pjjd.exe 2136 rlrxxxl.exe 1332 tnnbhn.exe 1212 tbnthb.exe 2576 pppvj.exe 2516 xxrflrf.exe 1272 tnhnht.exe 1544 tbhntb.exe -
resource yara_rule behavioral1/memory/1316-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-329-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2612-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-418-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 752 1316 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 30 PID 1316 wrote to memory of 752 1316 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 30 PID 1316 wrote to memory of 752 1316 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 30 PID 1316 wrote to memory of 752 1316 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 30 PID 752 wrote to memory of 2072 752 pvpdd.exe 31 PID 752 wrote to memory of 2072 752 pvpdd.exe 31 PID 752 wrote to memory of 2072 752 pvpdd.exe 31 PID 752 wrote to memory of 2072 752 pvpdd.exe 31 PID 2072 wrote to memory of 2812 2072 rxxllfl.exe 32 PID 2072 wrote to memory of 2812 2072 rxxllfl.exe 32 PID 2072 wrote to memory of 2812 2072 rxxllfl.exe 32 PID 2072 wrote to memory of 2812 2072 rxxllfl.exe 32 PID 2812 wrote to memory of 2992 2812 pvvdj.exe 33 PID 2812 wrote to memory of 2992 2812 pvvdj.exe 33 PID 2812 wrote to memory of 2992 2812 pvvdj.exe 33 PID 2812 wrote to memory of 2992 2812 pvvdj.exe 33 PID 2992 wrote to memory of 2252 2992 tntbbh.exe 34 PID 2992 wrote to memory of 2252 2992 tntbbh.exe 34 PID 2992 wrote to memory of 2252 2992 tntbbh.exe 34 PID 2992 wrote to memory of 2252 2992 tntbbh.exe 34 PID 2252 wrote to memory of 2952 2252 jdvdp.exe 35 PID 2252 wrote to memory of 2952 2252 jdvdp.exe 35 PID 2252 wrote to memory of 2952 2252 jdvdp.exe 35 PID 2252 wrote to memory of 2952 2252 jdvdp.exe 35 PID 2952 wrote to memory of 2740 2952 xlrllrx.exe 36 PID 2952 wrote to memory of 2740 2952 xlrllrx.exe 36 PID 2952 wrote to memory of 2740 2952 xlrllrx.exe 36 PID 2952 wrote to memory of 2740 2952 xlrllrx.exe 36 PID 2740 wrote to memory of 2620 2740 tttbnn.exe 37 PID 2740 wrote to memory of 2620 2740 tttbnn.exe 37 PID 2740 wrote to memory of 2620 2740 tttbnn.exe 37 PID 2740 wrote to memory of 2620 2740 tttbnn.exe 37 PID 2620 wrote to memory of 2084 2620 vdvpj.exe 38 PID 2620 wrote to memory of 2084 2620 vdvpj.exe 38 PID 2620 wrote to memory of 2084 2620 vdvpj.exe 38 PID 2620 wrote to memory of 2084 2620 vdvpj.exe 38 PID 2084 wrote to memory of 2544 2084 fflxrlr.exe 39 PID 2084 wrote to memory of 2544 2084 fflxrlr.exe 39 PID 2084 wrote to memory of 2544 2084 fflxrlr.exe 39 PID 2084 wrote to memory of 2544 2084 fflxrlr.exe 39 PID 2544 wrote to memory of 2692 2544 nhbhbh.exe 40 PID 2544 wrote to memory of 2692 2544 nhbhbh.exe 40 PID 2544 wrote to memory of 2692 2544 nhbhbh.exe 40 PID 2544 wrote to memory of 2692 2544 nhbhbh.exe 40 PID 2692 wrote to memory of 2132 2692 5rrflfx.exe 41 PID 2692 wrote to memory of 2132 2692 5rrflfx.exe 41 PID 2692 wrote to memory of 2132 2692 5rrflfx.exe 41 PID 2692 wrote to memory of 2132 2692 5rrflfx.exe 41 PID 2132 wrote to memory of 2580 2132 1tthnn.exe 42 PID 2132 wrote to memory of 2580 2132 1tthnn.exe 42 PID 2132 wrote to memory of 2580 2132 1tthnn.exe 42 PID 2132 wrote to memory of 2580 2132 1tthnn.exe 42 PID 2580 wrote to memory of 2376 2580 lrrllxr.exe 43 PID 2580 wrote to memory of 2376 2580 lrrllxr.exe 43 PID 2580 wrote to memory of 2376 2580 lrrllxr.exe 43 PID 2580 wrote to memory of 2376 2580 lrrllxr.exe 43 PID 2376 wrote to memory of 2588 2376 9tthbt.exe 44 PID 2376 wrote to memory of 2588 2376 9tthbt.exe 44 PID 2376 wrote to memory of 2588 2376 9tthbt.exe 44 PID 2376 wrote to memory of 2588 2376 9tthbt.exe 44 PID 2588 wrote to memory of 3048 2588 1jppp.exe 45 PID 2588 wrote to memory of 3048 2588 1jppp.exe 45 PID 2588 wrote to memory of 3048 2588 1jppp.exe 45 PID 2588 wrote to memory of 3048 2588 1jppp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\pvpdd.exec:\pvpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\rxxllfl.exec:\rxxllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\pvvdj.exec:\pvvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tntbbh.exec:\tntbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jdvdp.exec:\jdvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xlrllrx.exec:\xlrllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\tttbnn.exec:\tttbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vdvpj.exec:\vdvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fflxrlr.exec:\fflxrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\nhbhbh.exec:\nhbhbh.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\5rrflfx.exec:\5rrflfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1tthnn.exec:\1tthnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\lrrllxr.exec:\lrrllxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\9tthbt.exec:\9tthbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\1jppp.exec:\1jppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rfxlflx.exec:\rfxlflx.exe17⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nbbtnb.exec:\nbbtnb.exe18⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frxrfxx.exec:\frxrfxx.exe19⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3nbbtb.exec:\3nbbtb.exe20⤵
- Executes dropped EXE
PID:484 -
\??\c:\llrfffx.exec:\llrfffx.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9hbbbh.exec:\9hbbbh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:956 -
\??\c:\lxlfllr.exec:\lxlfllr.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1btbnh.exec:\1btbnh.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\pjdvj.exec:\pjdvj.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\llfllxx.exec:\llfllxx.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5nnnbh.exec:\5nnnbh.exe27⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rrxrlxr.exec:\rrxrlxr.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5ttnbh.exec:\5ttnbh.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\rflxfrx.exec:\rflxfrx.exe30⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dvpdp.exec:\dvpdp.exe32⤵
- Executes dropped EXE
PID:304 -
\??\c:\vvvpd.exec:\vvvpd.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\htbbnh.exec:\htbbnh.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nbhtbn.exec:\nbhtbn.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3jvjd.exec:\3jvjd.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\llllllx.exec:\llllllx.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhtth.exec:\tnhtth.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbbnbb.exec:\bbbnbb.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7pvvp.exec:\7pvvp.exe40⤵
- Executes dropped EXE
PID:2108 -
\??\c:\flllxll.exec:\flllxll.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbbhtb.exec:\bbbhtb.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbbhtt.exec:\hbbhtt.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vdvjv.exec:\vdvjv.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xxxxrfl.exec:\xxxxrfl.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ttthhb.exec:\ttthhb.exe46⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7djvd.exec:\7djvd.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9xrxrrf.exec:\9xrxrrf.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bhnbbn.exec:\bhnbbn.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pppdv.exec:\pppdv.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xxfrxfr.exec:\xxfrxfr.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlfrlxl.exec:\rlfrlxl.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\htbhhh.exec:\htbhhh.exe53⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdvjd.exec:\pdvjd.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxxxrxl.exec:\fxxxrxl.exe55⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ttbbht.exec:\ttbbht.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jddpd.exec:\jddpd.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5pjjd.exec:\5pjjd.exe58⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tnnbhn.exec:\tnnbhn.exe60⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tbnthb.exec:\tbnthb.exe61⤵
- Executes dropped EXE
PID:1212 -
\??\c:\pppvj.exec:\pppvj.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxrflrf.exec:\xxrflrf.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tnhnht.exec:\tnhnht.exe64⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tbhntb.exec:\tbhntb.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jpvpv.exec:\jpvpv.exe66⤵PID:1432
-
\??\c:\9rrlfll.exec:\9rrlfll.exe67⤵PID:1624
-
\??\c:\7nhbnb.exec:\7nhbnb.exe68⤵PID:3028
-
\??\c:\3tnbth.exec:\3tnbth.exe69⤵PID:1480
-
\??\c:\3jjpj.exec:\3jjpj.exe70⤵PID:3044
-
\??\c:\fflxrrr.exec:\fflxrrr.exe71⤵PID:2080
-
\??\c:\9rlrfrr.exec:\9rlrfrr.exe72⤵PID:1484
-
\??\c:\hbbhtt.exec:\hbbhtt.exe73⤵PID:2028
-
\??\c:\5vjvp.exec:\5vjvp.exe74⤵PID:1952
-
\??\c:\lxlllfl.exec:\lxlllfl.exe75⤵PID:2996
-
\??\c:\bhhtnt.exec:\bhhtnt.exe76⤵PID:2976
-
\??\c:\vpjvv.exec:\vpjvv.exe77⤵PID:1600
-
\??\c:\5vpdd.exec:\5vpdd.exe78⤵PID:2816
-
\??\c:\flfxxrl.exec:\flfxxrl.exe79⤵PID:2824
-
\??\c:\hnhbnb.exec:\hnhbnb.exe80⤵PID:2880
-
\??\c:\jjvpj.exec:\jjvpj.exe81⤵PID:2884
-
\??\c:\jdvpd.exec:\jdvpd.exe82⤵PID:2708
-
\??\c:\llrlrff.exec:\llrlrff.exe83⤵PID:688
-
\??\c:\nnhthn.exec:\nnhthn.exe84⤵PID:2600
-
\??\c:\pvvjv.exec:\pvvjv.exe85⤵PID:2656
-
\??\c:\pjjjj.exec:\pjjjj.exe86⤵PID:2596
-
\??\c:\xfflffr.exec:\xfflffr.exe87⤵PID:2056
-
\??\c:\htbtnb.exec:\htbtnb.exe88⤵PID:2216
-
\??\c:\djvjj.exec:\djvjj.exe89⤵PID:284
-
\??\c:\dvvjp.exec:\dvvjp.exe90⤵PID:2692
-
\??\c:\5llrrfx.exec:\5llrrfx.exe91⤵PID:2400
-
\??\c:\bbtnhn.exec:\bbtnhn.exe92⤵PID:3020
-
\??\c:\1ddvv.exec:\1ddvv.exe93⤵PID:2912
-
\??\c:\rfllxxf.exec:\rfllxxf.exe94⤵PID:2500
-
\??\c:\llxffrl.exec:\llxffrl.exe95⤵PID:2844
-
\??\c:\btnbhn.exec:\btnbhn.exe96⤵PID:2852
-
\??\c:\djpjv.exec:\djpjv.exe97⤵PID:2964
-
\??\c:\xrlfffr.exec:\xrlfffr.exe98⤵PID:1916
-
\??\c:\3lxfxrf.exec:\3lxfxrf.exe99⤵PID:2404
-
\??\c:\tbhbtn.exec:\tbhbtn.exe100⤵PID:2512
-
\??\c:\5dppp.exec:\5dppp.exe101⤵PID:2348
-
\??\c:\dddpv.exec:\dddpv.exe102⤵PID:2356
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe103⤵PID:2276
-
\??\c:\bbthnn.exec:\bbthnn.exe104⤵PID:2368
-
\??\c:\5jjdd.exec:\5jjdd.exe105⤵PID:1260
-
\??\c:\1xrfrfl.exec:\1xrfrfl.exe106⤵PID:2380
-
\??\c:\xxlxffr.exec:\xxlxffr.exe107⤵PID:912
-
\??\c:\ntthbt.exec:\ntthbt.exe108⤵PID:1628
-
\??\c:\pdpvp.exec:\pdpvp.exe109⤵PID:1552
-
\??\c:\xlfflll.exec:\xlfflll.exe110⤵PID:2140
-
\??\c:\lxfrfxf.exec:\lxfrfxf.exe111⤵PID:1648
-
\??\c:\hthbhh.exec:\hthbhh.exe112⤵PID:2492
-
\??\c:\vpjvj.exec:\vpjvj.exe113⤵PID:2268
-
\??\c:\fxxxffl.exec:\fxxxffl.exe114⤵PID:572
-
\??\c:\ntbbnn.exec:\ntbbnn.exe115⤵PID:1176
-
\??\c:\dddpj.exec:\dddpj.exe116⤵PID:2024
-
\??\c:\vdjvd.exec:\vdjvd.exe117⤵PID:3032
-
\??\c:\frrlrrl.exec:\frrlrrl.exe118⤵PID:296
-
\??\c:\tbtbnb.exec:\tbtbnb.exe119⤵PID:2224
-
\??\c:\3dpjp.exec:\3dpjp.exe120⤵PID:1944
-
\??\c:\xfrlrxx.exec:\xfrlrxx.exe121⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-