Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28/07/2024, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe
-
Size
198KB
-
MD5
05821510f28e0481e6987d3e08557d28
-
SHA1
4a73a669efb67f99f4371fe673eada5ddf44fab7
-
SHA256
b9dba10b3d5fb684ca1aeaa00e14f209aeedaafedb87b61ce2080c885aca6334
-
SHA512
6fab4b00de042b2d8deb58be12fc80757336aba09d7150b61f1be11e0f623f8b37e43567212077aad629bf438024c3ff800c233fc1e6c8d51d75c6275e1aebe8
-
SSDEEP
1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYsU58fnZ:EhOm2sI93UufdC67ciyt3ujFf7jafnZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3260-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 hthnht.exe 4992 vpvvv.exe 4532 lffxrll.exe 3916 rlrrrll.exe 1628 9hbttt.exe 996 ppjvv.exe 1356 fxfrrrl.exe 2628 hbntnn.exe 2204 xlfffxx.exe 4600 tnbtbt.exe 4968 pvvvj.exe 1660 ththtn.exe 1828 djdvv.exe 2308 rfxlffl.exe 4880 bbhhbb.exe 2264 5rxrrxx.exe 3912 bnbthb.exe 4564 tnhhhh.exe 2400 pppjj.exe 4684 bhbbhh.exe 4452 9ntttt.exe 5068 jvjdj.exe 2188 fflllll.exe 1288 nnbbbb.exe 3804 vdvjj.exe 1328 lrrlrxf.exe 4744 nnnnhn.exe 2816 bnbbbb.exe 3316 ddvvv.exe 3692 ffxxxfr.exe 3132 nthbhn.exe 5048 pddvv.exe 1160 7vjjv.exe 2364 llffrxx.exe 5004 bbnhbb.exe 1676 jvpjv.exe 3056 dvvvv.exe 3932 fxrlfxl.exe 4748 hhnttt.exe 3788 nnhtnn.exe 3852 vjdvv.exe 3564 xxlxlrl.exe 384 nhhhbb.exe 2072 tbhhht.exe 4204 7dddv.exe 3472 vpvpj.exe 1924 frxrrff.exe 4608 fllrflr.exe 3028 hhbbnn.exe 212 dpddd.exe 2004 vjvpp.exe 32 rrxrfff.exe 2944 fxxfflr.exe 1432 htntbn.exe 4020 djdjp.exe 1008 vvvpp.exe 5100 xlxxxxx.exe 216 bbhbbb.exe 3452 hhtnhh.exe 2420 pdvvp.exe 884 xrxxxxx.exe 4844 hntnbt.exe 4836 3bttth.exe 3460 pdvpp.exe -
resource yara_rule behavioral2/memory/3260-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-430-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 2072 3260 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 84 PID 3260 wrote to memory of 2072 3260 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 84 PID 3260 wrote to memory of 2072 3260 05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe 84 PID 2072 wrote to memory of 4992 2072 hthnht.exe 85 PID 2072 wrote to memory of 4992 2072 hthnht.exe 85 PID 2072 wrote to memory of 4992 2072 hthnht.exe 85 PID 4992 wrote to memory of 4532 4992 vpvvv.exe 86 PID 4992 wrote to memory of 4532 4992 vpvvv.exe 86 PID 4992 wrote to memory of 4532 4992 vpvvv.exe 86 PID 4532 wrote to memory of 3916 4532 lffxrll.exe 87 PID 4532 wrote to memory of 3916 4532 lffxrll.exe 87 PID 4532 wrote to memory of 3916 4532 lffxrll.exe 87 PID 3916 wrote to memory of 1628 3916 rlrrrll.exe 88 PID 3916 wrote to memory of 1628 3916 rlrrrll.exe 88 PID 3916 wrote to memory of 1628 3916 rlrrrll.exe 88 PID 1628 wrote to memory of 996 1628 9hbttt.exe 89 PID 1628 wrote to memory of 996 1628 9hbttt.exe 89 PID 1628 wrote to memory of 996 1628 9hbttt.exe 89 PID 996 wrote to memory of 1356 996 ppjvv.exe 90 PID 996 wrote to memory of 1356 996 ppjvv.exe 90 PID 996 wrote to memory of 1356 996 ppjvv.exe 90 PID 1356 wrote to memory of 2628 1356 fxfrrrl.exe 91 PID 1356 wrote to memory of 2628 1356 fxfrrrl.exe 91 PID 1356 wrote to memory of 2628 1356 fxfrrrl.exe 91 PID 2628 wrote to memory of 2204 2628 hbntnn.exe 92 PID 2628 wrote to memory of 2204 2628 hbntnn.exe 92 PID 2628 wrote to memory of 2204 2628 hbntnn.exe 92 PID 2204 wrote to memory of 4600 2204 xlfffxx.exe 93 PID 2204 wrote to memory of 4600 2204 xlfffxx.exe 93 PID 2204 wrote to memory of 4600 2204 xlfffxx.exe 93 PID 4600 wrote to memory of 4968 4600 tnbtbt.exe 94 PID 4600 wrote to memory of 4968 4600 tnbtbt.exe 94 PID 4600 wrote to memory of 4968 4600 tnbtbt.exe 94 PID 4968 wrote to memory of 1660 4968 pvvvj.exe 95 PID 4968 wrote to memory of 1660 4968 pvvvj.exe 95 PID 4968 wrote to memory of 1660 4968 pvvvj.exe 95 PID 1660 wrote to memory of 1828 1660 ththtn.exe 97 PID 1660 wrote to memory of 1828 1660 ththtn.exe 97 PID 1660 wrote to memory of 1828 1660 ththtn.exe 97 PID 1828 wrote to memory of 2308 1828 djdvv.exe 98 PID 1828 wrote to memory of 2308 1828 djdvv.exe 98 PID 1828 wrote to memory of 2308 1828 djdvv.exe 98 PID 2308 wrote to memory of 4880 2308 rfxlffl.exe 99 PID 2308 wrote to memory of 4880 2308 rfxlffl.exe 99 PID 2308 wrote to memory of 4880 2308 rfxlffl.exe 99 PID 4880 wrote to memory of 2264 4880 bbhhbb.exe 101 PID 4880 wrote to memory of 2264 4880 bbhhbb.exe 101 PID 4880 wrote to memory of 2264 4880 bbhhbb.exe 101 PID 2264 wrote to memory of 3912 2264 5rxrrxx.exe 102 PID 2264 wrote to memory of 3912 2264 5rxrrxx.exe 102 PID 2264 wrote to memory of 3912 2264 5rxrrxx.exe 102 PID 3912 wrote to memory of 4564 3912 bnbthb.exe 103 PID 3912 wrote to memory of 4564 3912 bnbthb.exe 103 PID 3912 wrote to memory of 4564 3912 bnbthb.exe 103 PID 4564 wrote to memory of 2400 4564 tnhhhh.exe 104 PID 4564 wrote to memory of 2400 4564 tnhhhh.exe 104 PID 4564 wrote to memory of 2400 4564 tnhhhh.exe 104 PID 2400 wrote to memory of 4684 2400 pppjj.exe 105 PID 2400 wrote to memory of 4684 2400 pppjj.exe 105 PID 2400 wrote to memory of 4684 2400 pppjj.exe 105 PID 4684 wrote to memory of 4452 4684 bhbbhh.exe 106 PID 4684 wrote to memory of 4452 4684 bhbbhh.exe 106 PID 4684 wrote to memory of 4452 4684 bhbbhh.exe 106 PID 4452 wrote to memory of 5068 4452 9ntttt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05821510f28e0481e6987d3e08557d28_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\hthnht.exec:\hthnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpvvv.exec:\vpvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\lffxrll.exec:\lffxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\rlrrrll.exec:\rlrrrll.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\9hbttt.exec:\9hbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\ppjvv.exec:\ppjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\fxfrrrl.exec:\fxfrrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\hbntnn.exec:\hbntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xlfffxx.exec:\xlfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tnbtbt.exec:\tnbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\pvvvj.exec:\pvvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\ththtn.exec:\ththtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\djdvv.exec:\djdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\rfxlffl.exec:\rfxlffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bbhhbb.exec:\bbhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\5rxrrxx.exec:\5rxrrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\bnbthb.exec:\bnbthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\tnhhhh.exec:\tnhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pppjj.exec:\pppjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bhbbhh.exec:\bhbbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\9ntttt.exec:\9ntttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\jvjdj.exec:\jvjdj.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fflllll.exec:\fflllll.exe24⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nnbbbb.exec:\nnbbbb.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdvjj.exec:\vdvjj.exe26⤵
- Executes dropped EXE
PID:3804 -
\??\c:\lrrlrxf.exec:\lrrlrxf.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\nnnnhn.exec:\nnnnhn.exe28⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bnbbbb.exec:\bnbbbb.exe29⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ddvvv.exec:\ddvvv.exe30⤵
- Executes dropped EXE
PID:3316 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe31⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nthbhn.exec:\nthbhn.exe32⤵
- Executes dropped EXE
PID:3132 -
\??\c:\pddvv.exec:\pddvv.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048 -
\??\c:\7vjjv.exec:\7vjjv.exe34⤵
- Executes dropped EXE
PID:1160 -
\??\c:\llffrxx.exec:\llffrxx.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bbnhbb.exec:\bbnhbb.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jvpjv.exec:\jvpjv.exe37⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvvvv.exec:\dvvvv.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe39⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hhnttt.exec:\hhnttt.exe40⤵
- Executes dropped EXE
PID:4748 -
\??\c:\nnhtnn.exec:\nnhtnn.exe41⤵
- Executes dropped EXE
PID:3788 -
\??\c:\vjdvv.exec:\vjdvv.exe42⤵
- Executes dropped EXE
PID:3852 -
\??\c:\xxlxlrl.exec:\xxlxlrl.exe43⤵
- Executes dropped EXE
PID:3564 -
\??\c:\nhhhbb.exec:\nhhhbb.exe44⤵
- Executes dropped EXE
PID:384 -
\??\c:\tbhhht.exec:\tbhhht.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7dddv.exec:\7dddv.exe46⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vpvpj.exec:\vpvpj.exe47⤵
- Executes dropped EXE
PID:3472 -
\??\c:\frxrrff.exec:\frxrrff.exe48⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fllrflr.exec:\fllrflr.exe49⤵
- Executes dropped EXE
PID:4608 -
\??\c:\hhbbnn.exec:\hhbbnn.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dpddd.exec:\dpddd.exe51⤵
- Executes dropped EXE
PID:212 -
\??\c:\vjvpp.exec:\vjvpp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrxrfff.exec:\rrxrfff.exe53⤵
- Executes dropped EXE
PID:32 -
\??\c:\fxxfflr.exec:\fxxfflr.exe54⤵
- Executes dropped EXE
PID:2944 -
\??\c:\htntbn.exec:\htntbn.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\djdjp.exec:\djdjp.exe56⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vvvpp.exec:\vvvpp.exe57⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe58⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bbhbbb.exec:\bbhbbb.exe59⤵
- Executes dropped EXE
PID:216 -
\??\c:\hhtnhh.exec:\hhtnhh.exe60⤵
- Executes dropped EXE
PID:3452 -
\??\c:\pdvvp.exec:\pdvvp.exe61⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\hntnbt.exec:\hntnbt.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3bttth.exec:\3bttth.exe64⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pdvpp.exec:\pdvpp.exe65⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xrllfll.exec:\xrllfll.exe66⤵PID:1304
-
\??\c:\nhttnt.exec:\nhttnt.exe67⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\thhnbh.exec:\thhnbh.exe68⤵PID:3684
-
\??\c:\1jvvp.exec:\1jvvp.exe69⤵PID:3252
-
\??\c:\lxxlfrr.exec:\lxxlfrr.exe70⤵PID:1524
-
\??\c:\hthbtt.exec:\hthbtt.exe71⤵PID:3468
-
\??\c:\tthhhn.exec:\tthhhn.exe72⤵PID:2152
-
\??\c:\dvpdd.exec:\dvpdd.exe73⤵PID:4128
-
\??\c:\5djjj.exec:\5djjj.exe74⤵PID:2188
-
\??\c:\flffxlf.exec:\flffxlf.exe75⤵PID:4316
-
\??\c:\ntbhhh.exec:\ntbhhh.exe76⤵PID:2928
-
\??\c:\nnhhnt.exec:\nnhhnt.exe77⤵PID:1664
-
\??\c:\vvddj.exec:\vvddj.exe78⤵PID:3112
-
\??\c:\vjdvv.exec:\vjdvv.exe79⤵PID:748
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe80⤵PID:2816
-
\??\c:\5hhhhn.exec:\5hhhhn.exe81⤵PID:3592
-
\??\c:\3tnnnn.exec:\3tnnnn.exe82⤵PID:1724
-
\??\c:\dpjjj.exec:\dpjjj.exe83⤵PID:4900
-
\??\c:\pdppj.exec:\pdppj.exe84⤵PID:1148
-
\??\c:\rrflrff.exec:\rrflrff.exe85⤵PID:4444
-
\??\c:\bhttnn.exec:\bhttnn.exe86⤵PID:952
-
\??\c:\jpdvd.exec:\jpdvd.exe87⤵PID:2276
-
\??\c:\3pdjv.exec:\3pdjv.exe88⤵PID:1988
-
\??\c:\5xrrflr.exec:\5xrrflr.exe89⤵PID:4060
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe90⤵PID:3856
-
\??\c:\hthtbn.exec:\hthtbn.exe91⤵PID:4404
-
\??\c:\nhnnbh.exec:\nhnnbh.exe92⤵PID:968
-
\??\c:\vppjd.exec:\vppjd.exe93⤵PID:1700
-
\??\c:\rxfxxll.exec:\rxfxxll.exe94⤵PID:3788
-
\??\c:\fllllll.exec:\fllllll.exe95⤵PID:1300
-
\??\c:\3bhhbt.exec:\3bhhbt.exe96⤵PID:3940
-
\??\c:\jpppp.exec:\jpppp.exe97⤵PID:384
-
\??\c:\lrxxlrr.exec:\lrxxlrr.exe98⤵PID:4104
-
\??\c:\rfllxfl.exec:\rfllxfl.exe99⤵PID:4228
-
\??\c:\tbbhbt.exec:\tbbhbt.exe100⤵
- System Location Discovery: System Language Discovery
PID:4224 -
\??\c:\vdvpp.exec:\vdvpp.exe101⤵PID:2620
-
\??\c:\thtbbh.exec:\thtbbh.exe102⤵PID:4916
-
\??\c:\hbhhhn.exec:\hbhhhn.exe103⤵PID:2372
-
\??\c:\vjjvv.exec:\vjjvv.exe104⤵PID:4924
-
\??\c:\rfrxlxl.exec:\rfrxlxl.exe105⤵PID:1152
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe106⤵PID:3152
-
\??\c:\hnnnnt.exec:\hnnnnt.exe107⤵PID:3992
-
\??\c:\vjddd.exec:\vjddd.exe108⤵PID:4688
-
\??\c:\rlxxfff.exec:\rlxxfff.exe109⤵PID:3292
-
\??\c:\lxrlflx.exec:\lxrlflx.exe110⤵PID:5076
-
\??\c:\bttttb.exec:\bttttb.exe111⤵PID:2600
-
\??\c:\dvppv.exec:\dvppv.exe112⤵PID:5052
-
\??\c:\jvppp.exec:\jvppp.exe113⤵PID:2932
-
\??\c:\fxlxxlf.exec:\fxlxxlf.exe114⤵PID:2288
-
\??\c:\nhhtth.exec:\nhhtth.exe115⤵PID:3548
-
\??\c:\hhnnnt.exec:\hhnnnt.exe116⤵PID:2936
-
\??\c:\jddjv.exec:\jddjv.exe117⤵PID:4024
-
\??\c:\jvddp.exec:\jvddp.exe118⤵PID:3912
-
\??\c:\xflllrx.exec:\xflllrx.exe119⤵PID:3816
-
\??\c:\nnnbbn.exec:\nnnbbn.exe120⤵PID:4148
-
\??\c:\vvjjj.exec:\vvjjj.exe121⤵PID:4132
-
\??\c:\dpjpv.exec:\dpjpv.exe122⤵PID:3380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-