Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 19:03
Behavioral task
behavioral1
Sample
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
-
Size
23KB
-
MD5
c1622f7d27f2dd3ec2d41b7302ce7e15
-
SHA1
e9f5548383f51bd199941201be2f5d667c6bacf4
-
SHA256
377c19038d5eff358621559827f4b91646d84424517246e716b89c3b28627234
-
SHA512
eb2cb5a15025f5c1fc25920aa5f342519974af5f4f96504084dc1d7868329ae18a41633c90961e721c5221c1bfe6431e4ff44ad1f8305f9b9f4fd4d1b274eba0
-
SSDEEP
384:WwznVKyqCvPSryiZuLwxu+Dl/p6aKPWpe:WQnwfCy2wxu+xAf
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2148 ecsgrldr.exe 2540 orclwy.exe 1816 fyyxkvfg.exe 2000 otnegulz.exe 2876 phckifi.exe 2612 biqwoeww.exe 2076 eryrg.exe 2652 edrulzx.exe 2648 xzuyv.exe 2220 fibvbws.exe 1836 kdfru.exe 1808 patjokwu.exe 284 bomuoaf.exe 1984 ughnmhkh.exe 2336 jltuut.exe 684 uyttttkm.exe 2848 pmfnia.exe 2240 oqpsq.exe 2564 nxage.exe 2256 dyfkk.exe 768 afdrhac.exe 1896 fyehabtz.exe 2812 iieqdd.exe 376 yvqxopv.exe 928 ejpcr.exe 1728 fwppptyw.exe 2472 mgusm.exe 356 iqlde.exe 696 rzysy.exe 2172 thbubyu.exe 1880 xppnmydf.exe 1804 rqdfmtye.exe 2196 oavub.exe 2264 bizsfvl.exe 2692 vpfkwfz.exe 2032 txslfeu.exe 2516 tmuhgl.exe 1156 wylgu.exe 2736 jpbnq.exe 3028 rmmskhc.exe 2904 errymjl.exe 2640 mwcbrel.exe 2780 prtej.exe 2616 lvhtw.exe 1220 bzzbfoy.exe 2836 aejvik.exe 1852 ltdgnxb.exe 2884 wgsipd.exe 2592 hacpf.exe 1372 kfsufi.exe 2964 mutbihju.exe 2832 yvyrhj.exe 2704 leglysl.exe 2168 ubykmaj.exe 1140 mgeysg.exe 2552 qixrv.exe 2468 hhmpzm.exe 1656 incqndju.exe 568 cebunrk.exe 2668 pucahj.exe 1484 wktnqrk.exe 2688 cohaeizi.exe 2112 dxqui.exe 2116 dxceel.exe -
Loads dropped DLL 64 IoCs
pid Process 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 2148 ecsgrldr.exe 2148 ecsgrldr.exe 2540 orclwy.exe 2540 orclwy.exe 1816 fyyxkvfg.exe 1816 fyyxkvfg.exe 2000 otnegulz.exe 2000 otnegulz.exe 2876 phckifi.exe 2876 phckifi.exe 2612 biqwoeww.exe 2612 biqwoeww.exe 2076 eryrg.exe 2076 eryrg.exe 2652 edrulzx.exe 2652 edrulzx.exe 2648 xzuyv.exe 2648 xzuyv.exe 2220 fibvbws.exe 2220 fibvbws.exe 1836 kdfru.exe 1836 kdfru.exe 1808 patjokwu.exe 1808 patjokwu.exe 284 bomuoaf.exe 284 bomuoaf.exe 1984 ughnmhkh.exe 1984 ughnmhkh.exe 2336 jltuut.exe 2336 jltuut.exe 684 uyttttkm.exe 684 uyttttkm.exe 2848 pmfnia.exe 2848 pmfnia.exe 2240 oqpsq.exe 2240 oqpsq.exe 2564 nxage.exe 2564 nxage.exe 2256 dyfkk.exe 2256 dyfkk.exe 768 afdrhac.exe 768 afdrhac.exe 1896 fyehabtz.exe 1896 fyehabtz.exe 2812 iieqdd.exe 2812 iieqdd.exe 376 yvqxopv.exe 376 yvqxopv.exe 928 ejpcr.exe 928 ejpcr.exe 1728 fwppptyw.exe 1728 fwppptyw.exe 2472 mgusm.exe 2472 mgusm.exe 356 iqlde.exe 356 iqlde.exe 696 rzysy.exe 696 rzysy.exe 2172 thbubyu.exe 2172 thbubyu.exe 1880 xppnmydf.exe 1880 xppnmydf.exe -
resource yara_rule behavioral1/memory/1600-0-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/files/0x000700000001211b-2.dat upx behavioral1/memory/2148-11-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2148-22-0x0000000000220000-0x0000000000230000-memory.dmp upx behavioral1/memory/1816-34-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2540-31-0x0000000000220000-0x0000000000230000-memory.dmp upx behavioral1/memory/2000-46-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2148-56-0x0000000000220000-0x0000000000230000-memory.dmp upx behavioral1/memory/2876-66-0x00000000002A0000-0x00000000002B0000-memory.dmp upx behavioral1/memory/2612-76-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/2220-105-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2612-104-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/1808-124-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/2240-172-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/684-183-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/1804-246-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral1/memory/1796-479-0x0000000000260000-0x0000000000270000-memory.dmp upx behavioral1/memory/3868-952-0x00000000001B0000-0x00000000001C0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hooprtj.exe" xatotk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rexor.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mxsyuqn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rlqor.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bbcwvov.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mfsgzur.exe" tqnmrvdv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ptwossdx.exe" hrldvph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wdvsyfa.exe" vwdnfqvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ppdmkvgx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dzmhcsae.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\juhnud.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hkxetmxd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\axwgan.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ohnqfcz.exe" cnlmidk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lqesru.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sfnotxce.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mwpxo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\djgwfkkw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mzdla.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sfedo.exe" fwfvbsac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wdbqaojv.exe" jpzewr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hkwmciw.exe" dcmaxzq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kgtln.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\isusnmu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hamrf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\godqwy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dkoqg.exe" zxwbgih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xzgwwvb.exe" lptjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sebpdcvs.exe" oqefpimk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\migpmojx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\glnbeceq.exe" lakouktt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oiapykyf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jvyqdz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ntnuhtl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zkdauo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xqfyk.exe" fucqpca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wgtiglb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\scikthnw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ffiwf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ugxswuwb.exe" jbldb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ijyhwb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\uapcx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xrbfjzx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\iieqdd.exe" fyehabtz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wdgxqek.exe" fvfwtr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\znzmfff.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ubqar.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bgylrid.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oysttiad.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qggrz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mwdslqu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tswrty.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qbpjwg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zjholw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oblhyt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cuckt.exe" xggrjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wkplvvsa.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\icmjvidk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mhixecqc.exe" gjlcdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zxwmi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tcykj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hvxrqewz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jprfusap.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jlagd.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mxwutdaq.exe sjykft.exe File opened for modification C:\Windows\SysWOW64\butdij.exe Process not Found File created C:\Windows\SysWOW64\rkgdsf.exe Process not Found File opened for modification C:\Windows\SysWOW64\yzkpe.exe Process not Found File created C:\Windows\SysWOW64\clqleqzj.exe egzwr.exe File created C:\Windows\SysWOW64\xejbxy.exe Process not Found File created C:\Windows\SysWOW64\vidztp.exe Process not Found File created C:\Windows\SysWOW64\vprohr.exe Process not Found File opened for modification C:\Windows\SysWOW64\mutbihju.exe kfsufi.exe File created C:\Windows\SysWOW64\oegtwdd.exe oduoqsl.exe File opened for modification C:\Windows\SysWOW64\hkusesq.exe Process not Found File created C:\Windows\SysWOW64\pgyrwzz.exe Process not Found File opened for modification C:\Windows\SysWOW64\yutgbmt.exe Process not Found File opened for modification C:\Windows\SysWOW64\ekbjz.exe Process not Found File opened for modification C:\Windows\SysWOW64\oktvfc.exe Process not Found File created C:\Windows\SysWOW64\oznaz.exe Process not Found File created C:\Windows\SysWOW64\vqedzflw.exe Process not Found File opened for modification C:\Windows\SysWOW64\jvucgrth.exe Process not Found File created C:\Windows\SysWOW64\hixty.exe Process not Found File created C:\Windows\SysWOW64\mdpdu.exe Process not Found File opened for modification C:\Windows\SysWOW64\qsinb.exe Process not Found File opened for modification C:\Windows\SysWOW64\gjmstjqb.exe Process not Found File created C:\Windows\SysWOW64\wpasrlei.exe Process not Found File created C:\Windows\SysWOW64\szppzrfm.exe Process not Found File opened for modification C:\Windows\SysWOW64\mspej.exe Process not Found File opened for modification C:\Windows\SysWOW64\xyvbbv.exe Process not Found File opened for modification C:\Windows\SysWOW64\xkjlmjs.exe Process not Found File opened for modification C:\Windows\SysWOW64\yrdqya.exe Process not Found File created C:\Windows\SysWOW64\ylfhpma.exe Process not Found File created C:\Windows\SysWOW64\izloou.exe Process not Found File opened for modification C:\Windows\SysWOW64\utrhzhx.exe mmkifxwm.exe File opened for modification C:\Windows\SysWOW64\fkatq.exe Process not Found File opened for modification C:\Windows\SysWOW64\eqtstyn.exe Process not Found File created C:\Windows\SysWOW64\xnbcy.exe nhmjmmp.exe File opened for modification C:\Windows\SysWOW64\svubast.exe Process not Found File created C:\Windows\SysWOW64\pqxuut.exe Process not Found File created C:\Windows\SysWOW64\wplhsk.exe Process not Found File created C:\Windows\SysWOW64\syqcl.exe Process not Found File created C:\Windows\SysWOW64\rvczccs.exe Process not Found File created C:\Windows\SysWOW64\vbiow.exe Process not Found File opened for modification C:\Windows\SysWOW64\xqfyk.exe fucqpca.exe File created C:\Windows\SysWOW64\dvyilr.exe bsqfhji.exe File opened for modification C:\Windows\SysWOW64\jhbsv.exe Process not Found File created C:\Windows\SysWOW64\uernmcc.exe Process not Found File created C:\Windows\SysWOW64\iuadbkz.exe Process not Found File opened for modification C:\Windows\SysWOW64\aygth.exe Process not Found File created C:\Windows\SysWOW64\ysmip.exe hnnkuy.exe File created C:\Windows\SysWOW64\wfnznh.exe Process not Found File created C:\Windows\SysWOW64\eeptuhfy.exe Process not Found File created C:\Windows\SysWOW64\owkbs.exe Process not Found File created C:\Windows\SysWOW64\ypcrpghj.exe Process not Found File opened for modification C:\Windows\SysWOW64\axrero.exe Process not Found File opened for modification C:\Windows\SysWOW64\kicerwv.exe Process not Found File created C:\Windows\SysWOW64\mfhdu.exe Process not Found File created C:\Windows\SysWOW64\zrxhn.exe Process not Found File opened for modification C:\Windows\SysWOW64\hkxetmxd.exe Process not Found File created C:\Windows\SysWOW64\idfwzz.exe rvvpvf.exe File opened for modification C:\Windows\SysWOW64\rfgspyqg.exe Process not Found File created C:\Windows\SysWOW64\wztfgx.exe Process not Found File opened for modification C:\Windows\SysWOW64\ogmkjqmp.exe Process not Found File created C:\Windows\SysWOW64\xdywrkx.exe bagsvpq.exe File created C:\Windows\SysWOW64\bddix.exe Process not Found File opened for modification C:\Windows\SysWOW64\oytcvwuu.exe Process not Found File created C:\Windows\SysWOW64\pvyjl.exe Process not Found -
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acpna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxoskkks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language myqxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljuqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lyjpgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ocdzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntfaazd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjffai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ytsco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogxogl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecimrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language edfyvzs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uxyre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wdlskt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe Token: SeDebugPrivilege 2148 ecsgrldr.exe Token: SeDebugPrivilege 2540 orclwy.exe Token: SeDebugPrivilege 1816 fyyxkvfg.exe Token: SeDebugPrivilege 2000 otnegulz.exe Token: SeDebugPrivilege 2876 phckifi.exe Token: SeDebugPrivilege 2612 biqwoeww.exe Token: SeDebugPrivilege 2076 eryrg.exe Token: SeDebugPrivilege 2652 edrulzx.exe Token: SeDebugPrivilege 2648 xzuyv.exe Token: SeDebugPrivilege 2220 fibvbws.exe Token: SeDebugPrivilege 1836 kdfru.exe Token: SeDebugPrivilege 1808 patjokwu.exe Token: SeDebugPrivilege 284 bomuoaf.exe Token: SeDebugPrivilege 1984 ughnmhkh.exe Token: SeDebugPrivilege 2336 jltuut.exe Token: SeDebugPrivilege 684 uyttttkm.exe Token: SeDebugPrivilege 2848 pmfnia.exe Token: SeDebugPrivilege 2240 oqpsq.exe Token: SeDebugPrivilege 2564 nxage.exe Token: SeDebugPrivilege 2256 dyfkk.exe Token: SeDebugPrivilege 768 afdrhac.exe Token: SeDebugPrivilege 1896 fyehabtz.exe Token: SeDebugPrivilege 2812 iieqdd.exe Token: SeDebugPrivilege 376 yvqxopv.exe Token: SeDebugPrivilege 928 ejpcr.exe Token: SeDebugPrivilege 1728 fwppptyw.exe Token: SeDebugPrivilege 2472 mgusm.exe Token: SeDebugPrivilege 356 iqlde.exe Token: SeDebugPrivilege 696 rzysy.exe Token: SeDebugPrivilege 2172 thbubyu.exe Token: SeDebugPrivilege 1880 xppnmydf.exe Token: SeDebugPrivilege 1804 rqdfmtye.exe Token: SeDebugPrivilege 3064 qzamh.exe Token: SeDebugPrivilege 2264 bizsfvl.exe Token: SeDebugPrivilege 2692 vpfkwfz.exe Token: SeDebugPrivilege 2032 txslfeu.exe Token: SeDebugPrivilege 2516 tmuhgl.exe Token: SeDebugPrivilege 1156 wylgu.exe Token: SeDebugPrivilege 2736 jpbnq.exe Token: SeDebugPrivilege 3028 rmmskhc.exe Token: SeDebugPrivilege 2904 errymjl.exe Token: SeDebugPrivilege 2640 mwcbrel.exe Token: SeDebugPrivilege 2780 prtej.exe Token: SeDebugPrivilege 2616 lvhtw.exe Token: SeDebugPrivilege 1220 bzzbfoy.exe Token: SeDebugPrivilege 2836 aejvik.exe Token: SeDebugPrivilege 1852 ltdgnxb.exe Token: SeDebugPrivilege 2884 wgsipd.exe Token: SeDebugPrivilege 2592 hacpf.exe Token: SeDebugPrivilege 1372 kfsufi.exe Token: SeDebugPrivilege 2964 mutbihju.exe Token: SeDebugPrivilege 2832 yvyrhj.exe Token: SeDebugPrivilege 2704 leglysl.exe Token: SeDebugPrivilege 2168 ubykmaj.exe Token: SeDebugPrivilege 1140 mgeysg.exe Token: SeDebugPrivilege 2552 qixrv.exe Token: SeDebugPrivilege 2468 hhmpzm.exe Token: SeDebugPrivilege 1656 incqndju.exe Token: SeDebugPrivilege 568 cebunrk.exe Token: SeDebugPrivilege 2668 pucahj.exe Token: SeDebugPrivilege 1484 wktnqrk.exe Token: SeDebugPrivilege 2688 cohaeizi.exe Token: SeDebugPrivilege 2112 dxqui.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2148 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 30 PID 1600 wrote to memory of 2148 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 30 PID 1600 wrote to memory of 2148 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 30 PID 1600 wrote to memory of 2148 1600 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 30 PID 2148 wrote to memory of 2540 2148 ecsgrldr.exe 31 PID 2148 wrote to memory of 2540 2148 ecsgrldr.exe 31 PID 2148 wrote to memory of 2540 2148 ecsgrldr.exe 31 PID 2148 wrote to memory of 2540 2148 ecsgrldr.exe 31 PID 2540 wrote to memory of 1816 2540 orclwy.exe 32 PID 2540 wrote to memory of 1816 2540 orclwy.exe 32 PID 2540 wrote to memory of 1816 2540 orclwy.exe 32 PID 2540 wrote to memory of 1816 2540 orclwy.exe 32 PID 1816 wrote to memory of 2000 1816 fyyxkvfg.exe 33 PID 1816 wrote to memory of 2000 1816 fyyxkvfg.exe 33 PID 1816 wrote to memory of 2000 1816 fyyxkvfg.exe 33 PID 1816 wrote to memory of 2000 1816 fyyxkvfg.exe 33 PID 2000 wrote to memory of 2876 2000 otnegulz.exe 34 PID 2000 wrote to memory of 2876 2000 otnegulz.exe 34 PID 2000 wrote to memory of 2876 2000 otnegulz.exe 34 PID 2000 wrote to memory of 2876 2000 otnegulz.exe 34 PID 2876 wrote to memory of 2612 2876 phckifi.exe 35 PID 2876 wrote to memory of 2612 2876 phckifi.exe 35 PID 2876 wrote to memory of 2612 2876 phckifi.exe 35 PID 2876 wrote to memory of 2612 2876 phckifi.exe 35 PID 2612 wrote to memory of 2076 2612 biqwoeww.exe 36 PID 2612 wrote to memory of 2076 2612 biqwoeww.exe 36 PID 2612 wrote to memory of 2076 2612 biqwoeww.exe 36 PID 2612 wrote to memory of 2076 2612 biqwoeww.exe 36 PID 2076 wrote to memory of 2652 2076 eryrg.exe 37 PID 2076 wrote to memory of 2652 2076 eryrg.exe 37 PID 2076 wrote to memory of 2652 2076 eryrg.exe 37 PID 2076 wrote to memory of 2652 2076 eryrg.exe 37 PID 2652 wrote to memory of 2648 2652 edrulzx.exe 38 PID 2652 wrote to memory of 2648 2652 edrulzx.exe 38 PID 2652 wrote to memory of 2648 2652 edrulzx.exe 38 PID 2652 wrote to memory of 2648 2652 edrulzx.exe 38 PID 2648 wrote to memory of 2220 2648 xzuyv.exe 39 PID 2648 wrote to memory of 2220 2648 xzuyv.exe 39 PID 2648 wrote to memory of 2220 2648 xzuyv.exe 39 PID 2648 wrote to memory of 2220 2648 xzuyv.exe 39 PID 2220 wrote to memory of 1836 2220 fibvbws.exe 40 PID 2220 wrote to memory of 1836 2220 fibvbws.exe 40 PID 2220 wrote to memory of 1836 2220 fibvbws.exe 40 PID 2220 wrote to memory of 1836 2220 fibvbws.exe 40 PID 1836 wrote to memory of 1808 1836 kdfru.exe 41 PID 1836 wrote to memory of 1808 1836 kdfru.exe 41 PID 1836 wrote to memory of 1808 1836 kdfru.exe 41 PID 1836 wrote to memory of 1808 1836 kdfru.exe 41 PID 1808 wrote to memory of 284 1808 patjokwu.exe 42 PID 1808 wrote to memory of 284 1808 patjokwu.exe 42 PID 1808 wrote to memory of 284 1808 patjokwu.exe 42 PID 1808 wrote to memory of 284 1808 patjokwu.exe 42 PID 284 wrote to memory of 1984 284 bomuoaf.exe 43 PID 284 wrote to memory of 1984 284 bomuoaf.exe 43 PID 284 wrote to memory of 1984 284 bomuoaf.exe 43 PID 284 wrote to memory of 1984 284 bomuoaf.exe 43 PID 1984 wrote to memory of 2336 1984 ughnmhkh.exe 44 PID 1984 wrote to memory of 2336 1984 ughnmhkh.exe 44 PID 1984 wrote to memory of 2336 1984 ughnmhkh.exe 44 PID 1984 wrote to memory of 2336 1984 ughnmhkh.exe 44 PID 2336 wrote to memory of 684 2336 jltuut.exe 45 PID 2336 wrote to memory of 684 2336 jltuut.exe 45 PID 2336 wrote to memory of 684 2336 jltuut.exe 45 PID 2336 wrote to memory of 684 2336 jltuut.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\ecsgrldr.exeC:\Windows\system32\ecsgrldr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\orclwy.exeC:\Windows\system32\orclwy.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\fyyxkvfg.exeC:\Windows\system32\fyyxkvfg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\otnegulz.exeC:\Windows\system32\otnegulz.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\phckifi.exeC:\Windows\system32\phckifi.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\biqwoeww.exeC:\Windows\system32\biqwoeww.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\eryrg.exeC:\Windows\system32\eryrg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\edrulzx.exeC:\Windows\system32\edrulzx.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\xzuyv.exeC:\Windows\system32\xzuyv.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\fibvbws.exeC:\Windows\system32\fibvbws.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\kdfru.exeC:\Windows\system32\kdfru.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\patjokwu.exeC:\Windows\system32\patjokwu.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\bomuoaf.exeC:\Windows\system32\bomuoaf.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Windows\SysWOW64\ughnmhkh.exeC:\Windows\system32\ughnmhkh.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\jltuut.exeC:\Windows\system32\jltuut.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\uyttttkm.exeC:\Windows\system32\uyttttkm.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Windows\SysWOW64\pmfnia.exeC:\Windows\system32\pmfnia.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\oqpsq.exeC:\Windows\system32\oqpsq.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\nxage.exeC:\Windows\system32\nxage.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\SysWOW64\dyfkk.exeC:\Windows\system32\dyfkk.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\afdrhac.exeC:\Windows\system32\afdrhac.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\SysWOW64\fyehabtz.exeC:\Windows\system32\fyehabtz.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Windows\SysWOW64\iieqdd.exeC:\Windows\system32\iieqdd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Windows\SysWOW64\yvqxopv.exeC:\Windows\system32\yvqxopv.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Windows\SysWOW64\ejpcr.exeC:\Windows\system32\ejpcr.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Windows\SysWOW64\fwppptyw.exeC:\Windows\system32\fwppptyw.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\SysWOW64\mgusm.exeC:\Windows\system32\mgusm.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2472 -
C:\Windows\SysWOW64\iqlde.exeC:\Windows\system32\iqlde.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:356 -
C:\Windows\SysWOW64\rzysy.exeC:\Windows\system32\rzysy.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\SysWOW64\thbubyu.exeC:\Windows\system32\thbubyu.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\xppnmydf.exeC:\Windows\system32\xppnmydf.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Windows\SysWOW64\rqdfmtye.exeC:\Windows\system32\rqdfmtye.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Windows\SysWOW64\oavub.exeC:\Windows\system32\oavub.exe34⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\qzamh.exeC:\Windows\system32\qzamh.exe35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Windows\SysWOW64\bizsfvl.exeC:\Windows\system32\bizsfvl.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Windows\SysWOW64\vpfkwfz.exeC:\Windows\system32\vpfkwfz.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692 -
C:\Windows\SysWOW64\txslfeu.exeC:\Windows\system32\txslfeu.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\tmuhgl.exeC:\Windows\system32\tmuhgl.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2516 -
C:\Windows\SysWOW64\wylgu.exeC:\Windows\system32\wylgu.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Windows\SysWOW64\jpbnq.exeC:\Windows\system32\jpbnq.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\SysWOW64\rmmskhc.exeC:\Windows\system32\rmmskhc.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\SysWOW64\errymjl.exeC:\Windows\system32\errymjl.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Windows\SysWOW64\mwcbrel.exeC:\Windows\system32\mwcbrel.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Windows\SysWOW64\prtej.exeC:\Windows\system32\prtej.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\SysWOW64\lvhtw.exeC:\Windows\system32\lvhtw.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Windows\SysWOW64\bzzbfoy.exeC:\Windows\system32\bzzbfoy.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\SysWOW64\aejvik.exeC:\Windows\system32\aejvik.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Windows\SysWOW64\ltdgnxb.exeC:\Windows\system32\ltdgnxb.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Windows\SysWOW64\wgsipd.exeC:\Windows\system32\wgsipd.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\SysWOW64\hacpf.exeC:\Windows\system32\hacpf.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\SysWOW64\kfsufi.exeC:\Windows\system32\kfsufi.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1372 -
C:\Windows\SysWOW64\mutbihju.exeC:\Windows\system32\mutbihju.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Windows\SysWOW64\yvyrhj.exeC:\Windows\system32\yvyrhj.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\leglysl.exeC:\Windows\system32\leglysl.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\SysWOW64\ubykmaj.exeC:\Windows\system32\ubykmaj.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\mgeysg.exeC:\Windows\system32\mgeysg.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Windows\SysWOW64\qixrv.exeC:\Windows\system32\qixrv.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\hhmpzm.exeC:\Windows\system32\hhmpzm.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\SysWOW64\incqndju.exeC:\Windows\system32\incqndju.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\cebunrk.exeC:\Windows\system32\cebunrk.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\SysWOW64\pucahj.exeC:\Windows\system32\pucahj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\SysWOW64\wktnqrk.exeC:\Windows\system32\wktnqrk.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\SysWOW64\cohaeizi.exeC:\Windows\system32\cohaeizi.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\dxqui.exeC:\Windows\system32\dxqui.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\dxceel.exeC:\Windows\system32\dxceel.exe66⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\muammrf.exeC:\Windows\system32\muammrf.exe67⤵PID:2944
-
C:\Windows\SysWOW64\kezoq.exeC:\Windows\system32\kezoq.exe68⤵PID:2920
-
C:\Windows\SysWOW64\dpxwygk.exeC:\Windows\system32\dpxwygk.exe69⤵PID:2480
-
C:\Windows\SysWOW64\jhgwd.exeC:\Windows\system32\jhgwd.exe70⤵PID:2744
-
C:\Windows\SysWOW64\vyuqf.exeC:\Windows\system32\vyuqf.exe71⤵PID:1732
-
C:\Windows\SysWOW64\omnfx.exeC:\Windows\system32\omnfx.exe72⤵PID:1796
-
C:\Windows\SysWOW64\fpqvfjq.exeC:\Windows\system32\fpqvfjq.exe73⤵PID:2020
-
C:\Windows\SysWOW64\nppmj.exeC:\Windows\system32\nppmj.exe74⤵PID:2152
-
C:\Windows\SysWOW64\fbezpd.exeC:\Windows\system32\fbezpd.exe75⤵PID:2792
-
C:\Windows\SysWOW64\jjepmlki.exeC:\Windows\system32\jjepmlki.exe76⤵PID:2968
-
C:\Windows\SysWOW64\crxeoo.exeC:\Windows\system32\crxeoo.exe77⤵PID:2488
-
C:\Windows\SysWOW64\lwnzeo.exeC:\Windows\system32\lwnzeo.exe78⤵PID:1900
-
C:\Windows\SysWOW64\sysquk.exeC:\Windows\system32\sysquk.exe79⤵PID:1332
-
C:\Windows\SysWOW64\bdqxsb.exeC:\Windows\system32\bdqxsb.exe80⤵PID:2248
-
C:\Windows\SysWOW64\cidkd.exeC:\Windows\system32\cidkd.exe81⤵PID:2120
-
C:\Windows\SysWOW64\ljianmw.exeC:\Windows\system32\ljianmw.exe82⤵PID:2448
-
C:\Windows\SysWOW64\uewbur.exeC:\Windows\system32\uewbur.exe83⤵PID:1212
-
C:\Windows\SysWOW64\cojlb.exeC:\Windows\system32\cojlb.exe84⤵PID:2512
-
C:\Windows\SysWOW64\sclfacvn.exeC:\Windows\system32\sclfacvn.exe85⤵PID:2360
-
C:\Windows\SysWOW64\jecuehrp.exeC:\Windows\system32\jecuehrp.exe86⤵PID:2856
-
C:\Windows\SysWOW64\qzlvl.exeC:\Windows\system32\qzlvl.exe87⤵PID:2928
-
C:\Windows\SysWOW64\wbxyviq.exeC:\Windows\system32\wbxyviq.exe88⤵PID:1236
-
C:\Windows\SysWOW64\ipjdhq.exeC:\Windows\system32\ipjdhq.exe89⤵PID:2676
-
C:\Windows\SysWOW64\iozdheki.exeC:\Windows\system32\iozdheki.exe90⤵PID:1504
-
C:\Windows\SysWOW64\upfdhfl.exeC:\Windows\system32\upfdhfl.exe91⤵PID:2984
-
C:\Windows\SysWOW64\egzwr.exeC:\Windows\system32\egzwr.exe92⤵
- Drops file in System32 directory
PID:448 -
C:\Windows\SysWOW64\clqleqzj.exeC:\Windows\system32\clqleqzj.exe93⤵PID:2584
-
C:\Windows\SysWOW64\mnovyet.exeC:\Windows\system32\mnovyet.exe94⤵PID:2960
-
C:\Windows\SysWOW64\xlgphg.exeC:\Windows\system32\xlgphg.exe95⤵PID:2476
-
C:\Windows\SysWOW64\xrfix.exeC:\Windows\system32\xrfix.exe96⤵PID:1704
-
C:\Windows\SysWOW64\oofukx.exeC:\Windows\system32\oofukx.exe97⤵PID:2924
-
C:\Windows\SysWOW64\jvutg.exeC:\Windows\system32\jvutg.exe98⤵PID:2208
-
C:\Windows\SysWOW64\xxsiau.exeC:\Windows\system32\xxsiau.exe99⤵PID:1620
-
C:\Windows\SysWOW64\hczipjpy.exeC:\Windows\system32\hczipjpy.exe100⤵PID:2824
-
C:\Windows\SysWOW64\ixndj.exeC:\Windows\system32\ixndj.exe101⤵PID:664
-
C:\Windows\SysWOW64\aourhd.exeC:\Windows\system32\aourhd.exe102⤵PID:1572
-
C:\Windows\SysWOW64\tjcxbxc.exeC:\Windows\system32\tjcxbxc.exe103⤵PID:1692
-
C:\Windows\SysWOW64\fhkpvi.exeC:\Windows\system32\fhkpvi.exe104⤵PID:1876
-
C:\Windows\SysWOW64\evxbd.exeC:\Windows\system32\evxbd.exe105⤵PID:1648
-
C:\Windows\SysWOW64\fpzahoc.exeC:\Windows\system32\fpzahoc.exe106⤵PID:1164
-
C:\Windows\SysWOW64\lyxuytdp.exeC:\Windows\system32\lyxuytdp.exe107⤵PID:2388
-
C:\Windows\SysWOW64\sdkcuhb.exeC:\Windows\system32\sdkcuhb.exe108⤵PID:1916
-
C:\Windows\SysWOW64\telilv.exeC:\Windows\system32\telilv.exe109⤵PID:2828
-
C:\Windows\SysWOW64\bwpixe.exeC:\Windows\system32\bwpixe.exe110⤵PID:2568
-
C:\Windows\SysWOW64\twhyi.exeC:\Windows\system32\twhyi.exe111⤵PID:1748
-
C:\Windows\SysWOW64\ckdwe.exeC:\Windows\system32\ckdwe.exe112⤵PID:1576
-
C:\Windows\SysWOW64\fdbpl.exeC:\Windows\system32\fdbpl.exe113⤵PID:1708
-
C:\Windows\SysWOW64\zpvpb.exeC:\Windows\system32\zpvpb.exe114⤵PID:1792
-
C:\Windows\SysWOW64\bjpvqji.exeC:\Windows\system32\bjpvqji.exe115⤵PID:1068
-
C:\Windows\SysWOW64\jatrogbo.exeC:\Windows\system32\jatrogbo.exe116⤵PID:3088
-
C:\Windows\SysWOW64\poalgu.exeC:\Windows\system32\poalgu.exe117⤵PID:3124
-
C:\Windows\SysWOW64\khkgw.exeC:\Windows\system32\khkgw.exe118⤵PID:3156
-
C:\Windows\SysWOW64\jyqxvgec.exeC:\Windows\system32\jyqxvgec.exe119⤵PID:3192
-
C:\Windows\SysWOW64\vkzfpii.exeC:\Windows\system32\vkzfpii.exe120⤵PID:3228
-
C:\Windows\SysWOW64\hyvopqoo.exeC:\Windows\system32\hyvopqoo.exe121⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-