Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe
-
Size
193KB
-
MD5
c07db0e082455da9c8d2e73c1771e327
-
SHA1
6979bde3c99c0858c701509d682af447e9ca28c8
-
SHA256
21b103f8171217323b6635e5614b390e4361cb0dd74790420f43dc8bd66420a7
-
SHA512
8b23aab6b024705b3ac50bc5867fc6325edb24227243053ac236be9de2474ad1d17e9484b1f89215de7f01dcccbe38267f37de6616c98b2d00e27b9c6a553f0f
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyByFEyDRZ8CsLj:PhOm2sI93UufdC67cihByiylmCsf
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2404-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-61-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2648-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-101-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2156-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-377-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/884-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-585-0x00000000005C0000-0x00000000005E9000-memory.dmp family_blackmoon behavioral1/memory/1976-820-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2352-966-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2024-1070-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-764-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/552-712-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2720-661-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-566-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-547-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1764-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-501-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2380-476-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-450-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-288-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/3040-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-164-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2860-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-143-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2912-134-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2272-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-1339-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2836-1364-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 btntbt.exe 2712 jjjdp.exe 2808 ppjpp.exe 2708 7xrfflx.exe 2988 hhhbnn.exe 2624 nbhnbn.exe 2648 3dvvj.exe 2660 ffrrfxr.exe 2156 ffffrfx.exe 1724 bbnnbn.exe 2948 ddvvj.exe 2272 ttthbh.exe 3016 nbbhbt.exe 2912 vpvdp.exe 2860 xxxfrlf.exe 3064 flrflfx.exe 2972 ntbnnt.exe 1720 jddvp.exe 2000 jpdpv.exe 2092 rrrllrl.exe 1808 tbnnhh.exe 812 bthbth.exe 2124 ddjdp.exe 1260 rrfflrx.exe 1652 tbhtht.exe 620 jjdjd.exe 1696 fxllrlr.exe 2392 thtttn.exe 3040 3hbhbh.exe 2308 ddvvj.exe 1468 xfrxlrr.exe 2372 flflfff.exe 2168 ttthhh.exe 2244 pvdvd.exe 2828 lrffrrl.exe 2752 tbbtnb.exe 2888 ttnhbn.exe 2628 3pjdp.exe 2736 7flrlrr.exe 2252 xxlrlrf.exe 3060 flfxxff.exe 2536 bhhnbh.exe 288 3hnhht.exe 1040 jvjdd.exe 2300 jppvv.exe 2644 lllxxlx.exe 2100 tnhttb.exe 2940 nhbtht.exe 2052 5vdpp.exe 3048 3dvpd.exe 448 xxxlffx.exe 2180 llllxfx.exe 536 bhhbht.exe 344 ttbthb.exe 1792 3jjpj.exe 1248 rxlxrlx.exe 2396 5bnhnn.exe 2196 5hbnhb.exe 1372 5jddj.exe 2380 pppvv.exe 1864 xfrlxrl.exe 2844 llflxlr.exe 848 bthhnn.exe 484 bbbtth.exe -
resource yara_rule behavioral1/memory/2404-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-325-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-935-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-967-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-891-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-981-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-1070-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-661-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-566-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-527-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-476-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-450-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-288-0x0000000077420000-0x000000007753F000-memory.dmp upx behavioral1/memory/3040-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-143-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2272-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-1139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-1201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-1251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-1264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-1277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-1352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-1364-0x00000000001B0000-0x00000000001D9000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2224 2404 c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2224 2404 c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2224 2404 c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2224 2404 c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe 30 PID 2224 wrote to memory of 2712 2224 btntbt.exe 31 PID 2224 wrote to memory of 2712 2224 btntbt.exe 31 PID 2224 wrote to memory of 2712 2224 btntbt.exe 31 PID 2224 wrote to memory of 2712 2224 btntbt.exe 31 PID 2712 wrote to memory of 2808 2712 jjjdp.exe 32 PID 2712 wrote to memory of 2808 2712 jjjdp.exe 32 PID 2712 wrote to memory of 2808 2712 jjjdp.exe 32 PID 2712 wrote to memory of 2808 2712 jjjdp.exe 32 PID 2808 wrote to memory of 2708 2808 ppjpp.exe 108 PID 2808 wrote to memory of 2708 2808 ppjpp.exe 108 PID 2808 wrote to memory of 2708 2808 ppjpp.exe 108 PID 2808 wrote to memory of 2708 2808 ppjpp.exe 108 PID 2708 wrote to memory of 2988 2708 7xrfflx.exe 34 PID 2708 wrote to memory of 2988 2708 7xrfflx.exe 34 PID 2708 wrote to memory of 2988 2708 7xrfflx.exe 34 PID 2708 wrote to memory of 2988 2708 7xrfflx.exe 34 PID 2988 wrote to memory of 2624 2988 hhhbnn.exe 35 PID 2988 wrote to memory of 2624 2988 hhhbnn.exe 35 PID 2988 wrote to memory of 2624 2988 hhhbnn.exe 35 PID 2988 wrote to memory of 2624 2988 hhhbnn.exe 35 PID 2624 wrote to memory of 2648 2624 nbhnbn.exe 36 PID 2624 wrote to memory of 2648 2624 nbhnbn.exe 36 PID 2624 wrote to memory of 2648 2624 nbhnbn.exe 36 PID 2624 wrote to memory of 2648 2624 nbhnbn.exe 36 PID 2648 wrote to memory of 2660 2648 3dvvj.exe 37 PID 2648 wrote to memory of 2660 2648 3dvvj.exe 37 PID 2648 wrote to memory of 2660 2648 3dvvj.exe 37 PID 2648 wrote to memory of 2660 2648 3dvvj.exe 37 PID 2660 wrote to memory of 2156 2660 ffrrfxr.exe 155 PID 2660 wrote to memory of 2156 2660 ffrrfxr.exe 155 PID 2660 wrote to memory of 2156 2660 ffrrfxr.exe 155 PID 2660 wrote to memory of 2156 2660 ffrrfxr.exe 155 PID 2156 wrote to memory of 1724 2156 ffffrfx.exe 39 PID 2156 wrote to memory of 1724 2156 ffffrfx.exe 39 PID 2156 wrote to memory of 1724 2156 ffffrfx.exe 39 PID 2156 wrote to memory of 1724 2156 ffffrfx.exe 39 PID 1724 wrote to memory of 2948 1724 bbnnbn.exe 116 PID 1724 wrote to memory of 2948 1724 bbnnbn.exe 116 PID 1724 wrote to memory of 2948 1724 bbnnbn.exe 116 PID 1724 wrote to memory of 2948 1724 bbnnbn.exe 116 PID 2948 wrote to memory of 2272 2948 ddvvj.exe 41 PID 2948 wrote to memory of 2272 2948 ddvvj.exe 41 PID 2948 wrote to memory of 2272 2948 ddvvj.exe 41 PID 2948 wrote to memory of 2272 2948 ddvvj.exe 41 PID 2272 wrote to memory of 3016 2272 ttthbh.exe 42 PID 2272 wrote to memory of 3016 2272 ttthbh.exe 42 PID 2272 wrote to memory of 3016 2272 ttthbh.exe 42 PID 2272 wrote to memory of 3016 2272 ttthbh.exe 42 PID 3016 wrote to memory of 2912 3016 nbbhbt.exe 43 PID 3016 wrote to memory of 2912 3016 nbbhbt.exe 43 PID 3016 wrote to memory of 2912 3016 nbbhbt.exe 43 PID 3016 wrote to memory of 2912 3016 nbbhbt.exe 43 PID 2912 wrote to memory of 2860 2912 vpvdp.exe 44 PID 2912 wrote to memory of 2860 2912 vpvdp.exe 44 PID 2912 wrote to memory of 2860 2912 vpvdp.exe 44 PID 2912 wrote to memory of 2860 2912 vpvdp.exe 44 PID 2860 wrote to memory of 3064 2860 xxxfrlf.exe 45 PID 2860 wrote to memory of 3064 2860 xxxfrlf.exe 45 PID 2860 wrote to memory of 3064 2860 xxxfrlf.exe 45 PID 2860 wrote to memory of 3064 2860 xxxfrlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c07db0e082455da9c8d2e73c1771e327_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\btntbt.exec:\btntbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jjjdp.exec:\jjjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ppjpp.exec:\ppjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7xrfflx.exec:\7xrfflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hhhbnn.exec:\hhhbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nbhnbn.exec:\nbhnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3dvvj.exec:\3dvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ffffrfx.exec:\ffffrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\bbnnbn.exec:\bbnnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ddvvj.exec:\ddvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ttthbh.exec:\ttthbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\nbbhbt.exec:\nbbhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vpvdp.exec:\vpvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xxxfrlf.exec:\xxxfrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\flrflfx.exec:\flrflfx.exe17⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ntbnnt.exec:\ntbnnt.exe18⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jddvp.exec:\jddvp.exe19⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jpdpv.exec:\jpdpv.exe20⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrrllrl.exec:\rrrllrl.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tbnnhh.exec:\tbnnhh.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bthbth.exec:\bthbth.exe23⤵
- Executes dropped EXE
PID:812 -
\??\c:\ddjdp.exec:\ddjdp.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rrfflrx.exec:\rrfflrx.exe25⤵
- Executes dropped EXE
PID:1260 -
\??\c:\tbhtht.exec:\tbhtht.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jjdjd.exec:\jjdjd.exe27⤵
- Executes dropped EXE
PID:620 -
\??\c:\fxllrlr.exec:\fxllrlr.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\thtttn.exec:\thtttn.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3hbhbh.exec:\3hbhbh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\ddvvj.exec:\ddvvj.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xfrxlrr.exec:\xfrxlrr.exe32⤵
- Executes dropped EXE
PID:1468 -
\??\c:\flflfff.exec:\flflfff.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tbbhbb.exec:\tbbhbb.exe34⤵PID:1292
-
\??\c:\ttthhh.exec:\ttthhh.exe35⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pvdvd.exec:\pvdvd.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lrffrrl.exec:\lrffrrl.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tbbtnb.exec:\tbbtnb.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ttnhbn.exec:\ttnhbn.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3pjdp.exec:\3pjdp.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7flrlrr.exec:\7flrlrr.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\flfxxff.exec:\flfxxff.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhhnbh.exec:\bhhnbh.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3hnhht.exec:\3hnhht.exe45⤵
- Executes dropped EXE
PID:288 -
\??\c:\jvjdd.exec:\jvjdd.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jppvv.exec:\jppvv.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lllxxlx.exec:\lllxxlx.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnhttb.exec:\tnhttb.exe49⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nhbtht.exec:\nhbtht.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5vdpp.exec:\5vdpp.exe51⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3dvpd.exec:\3dvpd.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xxxlffx.exec:\xxxlffx.exe53⤵
- Executes dropped EXE
PID:448 -
\??\c:\llllxfx.exec:\llllxfx.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bhhbht.exec:\bhhbht.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\ttbthb.exec:\ttbthb.exe56⤵
- Executes dropped EXE
PID:344 -
\??\c:\3jjpj.exec:\3jjpj.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rxlxrlx.exec:\rxlxrlx.exe58⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5bnhnn.exec:\5bnhnn.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5hbnhb.exec:\5hbnhb.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5jddj.exec:\5jddj.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pppvv.exec:\pppvv.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xfrlxrl.exec:\xfrlxrl.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\llflxlr.exec:\llflxlr.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bthhnn.exec:\bthhnn.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\bbbtth.exec:\bbbtth.exe66⤵
- Executes dropped EXE
PID:484 -
\??\c:\1jjjp.exec:\1jjjp.exe67⤵PID:1688
-
\??\c:\pdpdv.exec:\pdpdv.exe68⤵PID:1480
-
\??\c:\3xfxrll.exec:\3xfxrll.exe69⤵PID:3024
-
\??\c:\xfxxrfx.exec:\xfxxrfx.exe70⤵PID:1764
-
\??\c:\nnnhtb.exec:\nnnhtb.exe71⤵PID:884
-
\??\c:\ttthbh.exec:\ttthbh.exe72⤵PID:2456
-
\??\c:\ppppj.exec:\ppppj.exe73⤵PID:2224
-
\??\c:\jpppp.exec:\jpppp.exe74⤵PID:1576
-
\??\c:\pjvdd.exec:\pjvdd.exe75⤵PID:1036
-
\??\c:\fffxrxx.exec:\fffxrxx.exe76⤵PID:2796
-
\??\c:\ttttnh.exec:\ttttnh.exe77⤵PID:2992
-
\??\c:\nnhtnt.exec:\nnhtnt.exe78⤵PID:3004
-
\??\c:\7nhnht.exec:\7nhnht.exe79⤵PID:2752
-
\??\c:\ddvpv.exec:\ddvpv.exe80⤵PID:2708
-
\??\c:\9fllxrr.exec:\9fllxrr.exe81⤵PID:2908
-
\??\c:\xflxxrf.exec:\xflxxrf.exe82⤵PID:1952
-
\??\c:\fllrrlf.exec:\fllrrlf.exe83⤵PID:2676
-
\??\c:\5ttbbn.exec:\5ttbbn.exe84⤵PID:2632
-
\??\c:\9hbnnh.exec:\9hbnnh.exe85⤵PID:1152
-
\??\c:\djvdv.exec:\djvdv.exe86⤵PID:2536
-
\??\c:\vvpdv.exec:\vvpdv.exe87⤵PID:288
-
\??\c:\rfxxflx.exec:\rfxxflx.exe88⤵PID:2948
-
\??\c:\ffxrfrl.exec:\ffxrfrl.exe89⤵PID:1748
-
\??\c:\hntnnh.exec:\hntnnh.exe90⤵PID:3008
-
\??\c:\tnhbtb.exec:\tnhbtb.exe91⤵PID:2720
-
\??\c:\5jpvj.exec:\5jpvj.exe92⤵PID:2932
-
\??\c:\jjddv.exec:\jjddv.exe93⤵PID:2640
-
\??\c:\rxlrrxx.exec:\rxlrrxx.exe94⤵PID:1968
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe95⤵PID:2336
-
\??\c:\nhbnbh.exec:\nhbnbh.exe96⤵PID:548
-
\??\c:\ppppp.exec:\ppppp.exe97⤵PID:2744
-
\??\c:\dpjjp.exec:\dpjjp.exe98⤵PID:1672
-
\??\c:\ffrllff.exec:\ffrllff.exe99⤵PID:552
-
\??\c:\7bnhbn.exec:\7bnhbn.exe100⤵PID:1264
-
\??\c:\bthnbb.exec:\bthnbb.exe101⤵PID:2232
-
\??\c:\pjpvj.exec:\pjpvj.exe102⤵PID:2368
-
\??\c:\jpvvd.exec:\jpvvd.exe103⤵PID:2188
-
\??\c:\xrllrxl.exec:\xrllrxl.exe104⤵PID:1632
-
\??\c:\7xrlxfr.exec:\7xrlxfr.exe105⤵PID:764
-
\??\c:\7nnbbh.exec:\7nnbbh.exe106⤵PID:2220
-
\??\c:\hhnbtt.exec:\hhnbtt.exe107⤵PID:1524
-
\??\c:\ddpdp.exec:\ddpdp.exe108⤵PID:2324
-
\??\c:\vdvdp.exec:\vdvdp.exe109⤵PID:468
-
\??\c:\ffrfrfx.exec:\ffrfrfx.exe110⤵PID:2080
-
\??\c:\9xxllxr.exec:\9xxllxr.exe111⤵PID:2036
-
\??\c:\ntttbh.exec:\ntttbh.exe112⤵PID:304
-
\??\c:\nhthnb.exec:\nhthnb.exe113⤵PID:296
-
\??\c:\vddvv.exec:\vddvv.exe114⤵PID:752
-
\??\c:\1jpvj.exec:\1jpvj.exe115⤵PID:2780
-
\??\c:\7rxlrfx.exec:\7rxlrfx.exe116⤵PID:1976
-
\??\c:\3xxlfrf.exec:\3xxlfrf.exe117⤵PID:2168
-
\??\c:\nhnntb.exec:\nhnntb.exe118⤵PID:1804
-
\??\c:\nnhtht.exec:\nnhtht.exe119⤵PID:2804
-
\??\c:\5dppj.exec:\5dppj.exe120⤵PID:2764
-
\??\c:\3lffrlf.exec:\3lffrlf.exe121⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-