Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 19:03
Behavioral task
behavioral1
Sample
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe
-
Size
23KB
-
MD5
c1622f7d27f2dd3ec2d41b7302ce7e15
-
SHA1
e9f5548383f51bd199941201be2f5d667c6bacf4
-
SHA256
377c19038d5eff358621559827f4b91646d84424517246e716b89c3b28627234
-
SHA512
eb2cb5a15025f5c1fc25920aa5f342519974af5f4f96504084dc1d7868329ae18a41633c90961e721c5221c1bfe6431e4ff44ad1f8305f9b9f4fd4d1b274eba0
-
SSDEEP
384:WwznVKyqCvPSryiZuLwxu+Dl/p6aKPWpe:WQnwfCy2wxu+xAf
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3788 pqcbjmmz.exe 2672 huaasj.exe 3388 bsssfjdi.exe 3352 nxpbel.exe 2356 bnzxzcmk.exe 3460 zponftyw.exe 4484 aovegesy.exe 1172 movbbcpd.exe 2912 jptntp.exe 2000 ddjyv.exe 4000 ygjip.exe 4836 kqnnf.exe 3500 ofsxn.exe 3252 kephhqal.exe 1696 inlyqfdf.exe 1448 rdivdt.exe 1620 uvunlk.exe 1812 ednxvzch.exe 876 afxizt.exe 3472 ousjvhks.exe 1692 gfzbfajn.exe 2536 kcdtrkq.exe 1300 sgpzmy.exe 3832 iodrj.exe 1380 pcakkdjg.exe 1256 mfcnbhr.exe 4388 snvalhal.exe 3984 brwmeq.exe 1112 ofqiyfe.exe 4892 gwqapej.exe 536 wdnoryle.exe 1588 udptytb.exe 3608 bcyovl.exe 5044 cdhup.exe 1068 yqngqrp.exe 1784 hoacrr.exe 1088 kzkji.exe 620 vnqbi.exe 3444 hpkqgti.exe 4956 vpnjeb.exe 1648 dmlpcc.exe 3892 hjzcuxik.exe 5012 moavpwpj.exe 5036 iqyogupe.exe 3760 loazgn.exe 3328 royumig.exe 3492 kwvhujq.exe 4752 rijmrgj.exe 3872 pmiogg.exe 3088 cbpcs.exe 4072 yywkohoq.exe 3312 rnjjp.exe 4880 bdqmtc.exe 4292 rnbwak.exe 1536 vvpgrz.exe 940 rxidqpiw.exe 5016 hfmrqdsd.exe 2004 jbgbh.exe 2192 dygyack.exe 3804 hwhglje.exe 868 cydpa.exe 2464 ntnza.exe 4060 ddifxp.exe 2280 rrrgxm.exe -
resource yara_rule behavioral2/memory/3736-0-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/files/0x00090000000233ea-3.dat upx behavioral2/memory/3736-40-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/3788-45-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/1300-133-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/1380-138-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/1256-141-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/5044-158-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/4332-238-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/4448-262-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/5448-307-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/6040-350-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/5140-360-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/5368-366-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/6556-429-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/5376-2930-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/7508-3811-0x0000000031420000-0x0000000031430000-memory.dmp upx behavioral2/memory/9976-4376-0x0000000031420000-0x0000000031430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yvpxif.exe" thjla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lpanm.exe" ydaybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ccjrx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\btxjni.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ujilxh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jgche.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ktanjbf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oewwx.exe" ygxoebkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\gynuqaku.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cpyajiw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dtlkwprz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kjbjq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mvghelm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\godvw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\juzyqf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ubkem.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wjajzi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jfeclx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\klreg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\blwiswvo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oiyoccp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sslkrg.exe" dvmvqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vdevtk.exe" ppreyh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ejlpqgl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ivkllpb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\azvhatzf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fwbxnwu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nrnlvknu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lstmxwih.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\glqptdk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dueii.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bvybkw.exe" kszzjzug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\efifsqd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\woiwui.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\eveaxx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xfrsczmd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zsjxbqoe.exe" zhlccwk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yugpu.exe" owdph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xjardi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vphlm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qmnvony.exe" okhlbw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fbgwr.exe" hxlde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fluyydn.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\kqnnf.exe" ygjip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rnjjp.exe" yywkohoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qlcga.exe" arxjoqph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rtaoi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zuokfr.exe" awcfv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nnfteek.exe" bgjpgmt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wvlksxs.exe" axyotpy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\orbwcq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nmkgf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ccaivouz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cfrimq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lmxkksnv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\huuvo.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\avphkjhd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rsdpn.exe" peusv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\syvyce.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qifrt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\trqtsz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cyeddg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tkuua.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hpkqgti.exe" vnqbi.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ulrss.exe Process not Found File created C:\Windows\SysWOW64\xwgprwp.exe Process not Found File created C:\Windows\SysWOW64\xhcoepjj.exe Process not Found File opened for modification C:\Windows\SysWOW64\wtpnpaw.exe Process not Found File opened for modification C:\Windows\SysWOW64\dcocaty.exe Process not Found File opened for modification C:\Windows\SysWOW64\oqvosgw.exe Process not Found File opened for modification C:\Windows\SysWOW64\ufvigi.exe Process not Found File opened for modification C:\Windows\SysWOW64\fdhvb.exe Process not Found File opened for modification C:\Windows\SysWOW64\qopamvhw.exe Process not Found File created C:\Windows\SysWOW64\hqtzpnfe.exe aoigm.exe File opened for modification C:\Windows\SysWOW64\miwhqz.exe uccdx.exe File created C:\Windows\SysWOW64\dctefbuz.exe Process not Found File created C:\Windows\SysWOW64\yvhsejju.exe Process not Found File created C:\Windows\SysWOW64\bgikcd.exe tnbyag.exe File opened for modification C:\Windows\SysWOW64\hgmlfaqh.exe Process not Found File created C:\Windows\SysWOW64\tpbcd.exe Process not Found File created C:\Windows\SysWOW64\stsjeg.exe Process not Found File opened for modification C:\Windows\SysWOW64\qbnfaw.exe Process not Found File opened for modification C:\Windows\SysWOW64\qziecux.exe mrvegmjj.exe File opened for modification C:\Windows\SysWOW64\ltnmh.exe Process not Found File created C:\Windows\SysWOW64\tmgrte.exe Process not Found File created C:\Windows\SysWOW64\fawcig.exe Process not Found File created C:\Windows\SysWOW64\kuitryao.exe Process not Found File opened for modification C:\Windows\SysWOW64\xejnxnp.exe Process not Found File created C:\Windows\SysWOW64\adtgmrw.exe yvivesv.exe File opened for modification C:\Windows\SysWOW64\wnput.exe Process not Found File created C:\Windows\SysWOW64\wfgsnzn.exe Process not Found File opened for modification C:\Windows\SysWOW64\cnkeurd.exe Process not Found File created C:\Windows\SysWOW64\fjrnf.exe Process not Found File created C:\Windows\SysWOW64\ppcucnsk.exe Process not Found File created C:\Windows\SysWOW64\dusvzl.exe Process not Found File created C:\Windows\SysWOW64\ispupou.exe Process not Found File created C:\Windows\SysWOW64\whwme.exe Process not Found File opened for modification C:\Windows\SysWOW64\ihqgmcpa.exe Process not Found File created C:\Windows\SysWOW64\rggufomp.exe Process not Found File created C:\Windows\SysWOW64\jeajscxd.exe Process not Found File created C:\Windows\SysWOW64\zzsgvdnf.exe Process not Found File opened for modification C:\Windows\SysWOW64\ebsdgfxo.exe Process not Found File opened for modification C:\Windows\SysWOW64\pxhqgyq.exe Process not Found File created C:\Windows\SysWOW64\lpohg.exe Process not Found File created C:\Windows\SysWOW64\qbqmxvp.exe llylbwmh.exe File opened for modification C:\Windows\SysWOW64\wvvcxwqs.exe jlcltm.exe File opened for modification C:\Windows\SysWOW64\aebummj.exe Process not Found File created C:\Windows\SysWOW64\ffakwhw.exe Process not Found File opened for modification C:\Windows\SysWOW64\enanzgrx.exe Process not Found File created C:\Windows\SysWOW64\bxpxio.exe vwdguk.exe File opened for modification C:\Windows\SysWOW64\avphkjhd.exe Process not Found File created C:\Windows\SysWOW64\tmhkgqfp.exe Process not Found File opened for modification C:\Windows\SysWOW64\uqmes.exe Process not Found File created C:\Windows\SysWOW64\jbsgta.exe nlfml.exe File created C:\Windows\SysWOW64\amfdyo.exe Process not Found File created C:\Windows\SysWOW64\wweyd.exe Process not Found File created C:\Windows\SysWOW64\jcfslj.exe Process not Found File opened for modification C:\Windows\SysWOW64\mxuvawp.exe Process not Found File opened for modification C:\Windows\SysWOW64\avvckuh.exe Process not Found File opened for modification C:\Windows\SysWOW64\wdnoryle.exe gwqapej.exe File opened for modification C:\Windows\SysWOW64\oebaspjs.exe vqiftiv.exe File opened for modification C:\Windows\SysWOW64\betkggs.exe Process not Found File opened for modification C:\Windows\SysWOW64\qquvllzm.exe Process not Found File opened for modification C:\Windows\SysWOW64\bkblfsf.exe Process not Found File created C:\Windows\SysWOW64\dmwqfhq.exe Process not Found File opened for modification C:\Windows\SysWOW64\ybgfi.exe pzcbjz.exe File created C:\Windows\SysWOW64\hhbvl.exe Process not Found File opened for modification C:\Windows\SysWOW64\wakxzu.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbuamj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ukjyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yndzwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hkxbmvmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language enafo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnyy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggjzqyyl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lybhuw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zrvnfvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yrlnkgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cksorkgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zvojy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3736 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe Token: SeDebugPrivilege 3788 pqcbjmmz.exe Token: SeDebugPrivilege 2672 huaasj.exe Token: SeDebugPrivilege 3388 bsssfjdi.exe Token: SeDebugPrivilege 3352 nxpbel.exe Token: SeDebugPrivilege 2356 bnzxzcmk.exe Token: SeDebugPrivilege 3460 zponftyw.exe Token: SeDebugPrivilege 4484 aovegesy.exe Token: SeDebugPrivilege 1172 movbbcpd.exe Token: SeDebugPrivilege 2912 jptntp.exe Token: SeDebugPrivilege 2000 ddjyv.exe Token: SeDebugPrivilege 4000 ygjip.exe Token: SeDebugPrivilege 4836 kqnnf.exe Token: SeDebugPrivilege 3500 ofsxn.exe Token: SeDebugPrivilege 3252 kephhqal.exe Token: SeDebugPrivilege 1696 inlyqfdf.exe Token: SeDebugPrivilege 1448 rdivdt.exe Token: SeDebugPrivilege 1620 uvunlk.exe Token: SeDebugPrivilege 1812 ednxvzch.exe Token: SeDebugPrivilege 876 afxizt.exe Token: SeDebugPrivilege 3472 ousjvhks.exe Token: SeDebugPrivilege 1692 gfzbfajn.exe Token: SeDebugPrivilege 2536 kcdtrkq.exe Token: SeDebugPrivilege 1300 sgpzmy.exe Token: SeDebugPrivilege 3832 iodrj.exe Token: SeDebugPrivilege 1380 pcakkdjg.exe Token: SeDebugPrivilege 1256 mfcnbhr.exe Token: SeDebugPrivilege 4388 snvalhal.exe Token: SeDebugPrivilege 3984 brwmeq.exe Token: SeDebugPrivilege 1112 ofqiyfe.exe Token: SeDebugPrivilege 4892 gwqapej.exe Token: SeDebugPrivilege 536 wdnoryle.exe Token: SeDebugPrivilege 1588 udptytb.exe Token: SeDebugPrivilege 3608 bcyovl.exe Token: SeDebugPrivilege 5044 cdhup.exe Token: SeDebugPrivilege 1068 yqngqrp.exe Token: SeDebugPrivilege 1784 hoacrr.exe Token: SeDebugPrivilege 1088 kzkji.exe Token: SeDebugPrivilege 620 vnqbi.exe Token: SeDebugPrivilege 3444 hpkqgti.exe Token: SeDebugPrivilege 4956 vpnjeb.exe Token: SeDebugPrivilege 1648 dmlpcc.exe Token: SeDebugPrivilege 3892 hjzcuxik.exe Token: SeDebugPrivilege 5012 moavpwpj.exe Token: SeDebugPrivilege 5036 iqyogupe.exe Token: SeDebugPrivilege 3760 loazgn.exe Token: SeDebugPrivilege 3328 royumig.exe Token: SeDebugPrivilege 3492 kwvhujq.exe Token: SeDebugPrivilege 4752 rijmrgj.exe Token: SeDebugPrivilege 3872 pmiogg.exe Token: SeDebugPrivilege 3088 cbpcs.exe Token: SeDebugPrivilege 4072 yywkohoq.exe Token: SeDebugPrivilege 3312 rnjjp.exe Token: SeDebugPrivilege 4880 bdqmtc.exe Token: SeDebugPrivilege 4292 rnbwak.exe Token: SeDebugPrivilege 1536 vvpgrz.exe Token: SeDebugPrivilege 940 rxidqpiw.exe Token: SeDebugPrivilege 5016 hfmrqdsd.exe Token: SeDebugPrivilege 2004 jbgbh.exe Token: SeDebugPrivilege 2192 dygyack.exe Token: SeDebugPrivilege 3804 hwhglje.exe Token: SeDebugPrivilege 868 cydpa.exe Token: SeDebugPrivilege 2464 ntnza.exe Token: SeDebugPrivilege 4060 ddifxp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 3788 3736 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 84 PID 3736 wrote to memory of 3788 3736 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 84 PID 3736 wrote to memory of 3788 3736 c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe 84 PID 3788 wrote to memory of 2672 3788 pqcbjmmz.exe 85 PID 3788 wrote to memory of 2672 3788 pqcbjmmz.exe 85 PID 3788 wrote to memory of 2672 3788 pqcbjmmz.exe 85 PID 2672 wrote to memory of 3388 2672 huaasj.exe 86 PID 2672 wrote to memory of 3388 2672 huaasj.exe 86 PID 2672 wrote to memory of 3388 2672 huaasj.exe 86 PID 3388 wrote to memory of 3352 3388 bsssfjdi.exe 87 PID 3388 wrote to memory of 3352 3388 bsssfjdi.exe 87 PID 3388 wrote to memory of 3352 3388 bsssfjdi.exe 87 PID 3352 wrote to memory of 2356 3352 nxpbel.exe 88 PID 3352 wrote to memory of 2356 3352 nxpbel.exe 88 PID 3352 wrote to memory of 2356 3352 nxpbel.exe 88 PID 2356 wrote to memory of 3460 2356 bnzxzcmk.exe 89 PID 2356 wrote to memory of 3460 2356 bnzxzcmk.exe 89 PID 2356 wrote to memory of 3460 2356 bnzxzcmk.exe 89 PID 3460 wrote to memory of 4484 3460 zponftyw.exe 90 PID 3460 wrote to memory of 4484 3460 zponftyw.exe 90 PID 3460 wrote to memory of 4484 3460 zponftyw.exe 90 PID 4484 wrote to memory of 1172 4484 aovegesy.exe 91 PID 4484 wrote to memory of 1172 4484 aovegesy.exe 91 PID 4484 wrote to memory of 1172 4484 aovegesy.exe 91 PID 1172 wrote to memory of 2912 1172 movbbcpd.exe 92 PID 1172 wrote to memory of 2912 1172 movbbcpd.exe 92 PID 1172 wrote to memory of 2912 1172 movbbcpd.exe 92 PID 2912 wrote to memory of 2000 2912 jptntp.exe 93 PID 2912 wrote to memory of 2000 2912 jptntp.exe 93 PID 2912 wrote to memory of 2000 2912 jptntp.exe 93 PID 2000 wrote to memory of 4000 2000 ddjyv.exe 94 PID 2000 wrote to memory of 4000 2000 ddjyv.exe 94 PID 2000 wrote to memory of 4000 2000 ddjyv.exe 94 PID 4000 wrote to memory of 4836 4000 ygjip.exe 95 PID 4000 wrote to memory of 4836 4000 ygjip.exe 95 PID 4000 wrote to memory of 4836 4000 ygjip.exe 95 PID 4836 wrote to memory of 3500 4836 kqnnf.exe 96 PID 4836 wrote to memory of 3500 4836 kqnnf.exe 96 PID 4836 wrote to memory of 3500 4836 kqnnf.exe 96 PID 3500 wrote to memory of 3252 3500 ofsxn.exe 97 PID 3500 wrote to memory of 3252 3500 ofsxn.exe 97 PID 3500 wrote to memory of 3252 3500 ofsxn.exe 97 PID 3252 wrote to memory of 1696 3252 kephhqal.exe 98 PID 3252 wrote to memory of 1696 3252 kephhqal.exe 98 PID 3252 wrote to memory of 1696 3252 kephhqal.exe 98 PID 1696 wrote to memory of 1448 1696 inlyqfdf.exe 99 PID 1696 wrote to memory of 1448 1696 inlyqfdf.exe 99 PID 1696 wrote to memory of 1448 1696 inlyqfdf.exe 99 PID 1448 wrote to memory of 1620 1448 rdivdt.exe 101 PID 1448 wrote to memory of 1620 1448 rdivdt.exe 101 PID 1448 wrote to memory of 1620 1448 rdivdt.exe 101 PID 1620 wrote to memory of 1812 1620 uvunlk.exe 102 PID 1620 wrote to memory of 1812 1620 uvunlk.exe 102 PID 1620 wrote to memory of 1812 1620 uvunlk.exe 102 PID 1812 wrote to memory of 876 1812 ednxvzch.exe 103 PID 1812 wrote to memory of 876 1812 ednxvzch.exe 103 PID 1812 wrote to memory of 876 1812 ednxvzch.exe 103 PID 876 wrote to memory of 3472 876 afxizt.exe 104 PID 876 wrote to memory of 3472 876 afxizt.exe 104 PID 876 wrote to memory of 3472 876 afxizt.exe 104 PID 3472 wrote to memory of 1692 3472 ousjvhks.exe 105 PID 3472 wrote to memory of 1692 3472 ousjvhks.exe 105 PID 3472 wrote to memory of 1692 3472 ousjvhks.exe 105 PID 1692 wrote to memory of 2536 1692 gfzbfajn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c1622f7d27f2dd3ec2d41b7302ce7e15_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\pqcbjmmz.exeC:\Windows\system32\pqcbjmmz.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\huaasj.exeC:\Windows\system32\huaasj.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\bsssfjdi.exeC:\Windows\system32\bsssfjdi.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\nxpbel.exeC:\Windows\system32\nxpbel.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\bnzxzcmk.exeC:\Windows\system32\bnzxzcmk.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\zponftyw.exeC:\Windows\system32\zponftyw.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\aovegesy.exeC:\Windows\system32\aovegesy.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\movbbcpd.exeC:\Windows\system32\movbbcpd.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\jptntp.exeC:\Windows\system32\jptntp.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\ddjyv.exeC:\Windows\system32\ddjyv.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\ygjip.exeC:\Windows\system32\ygjip.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\kqnnf.exeC:\Windows\system32\kqnnf.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\ofsxn.exeC:\Windows\system32\ofsxn.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\kephhqal.exeC:\Windows\system32\kephhqal.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\inlyqfdf.exeC:\Windows\system32\inlyqfdf.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\rdivdt.exeC:\Windows\system32\rdivdt.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\uvunlk.exeC:\Windows\system32\uvunlk.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\ednxvzch.exeC:\Windows\system32\ednxvzch.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\afxizt.exeC:\Windows\system32\afxizt.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\ousjvhks.exeC:\Windows\system32\ousjvhks.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\gfzbfajn.exeC:\Windows\system32\gfzbfajn.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\kcdtrkq.exeC:\Windows\system32\kcdtrkq.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\SysWOW64\sgpzmy.exeC:\Windows\system32\sgpzmy.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Windows\SysWOW64\iodrj.exeC:\Windows\system32\iodrj.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3832 -
C:\Windows\SysWOW64\pcakkdjg.exeC:\Windows\system32\pcakkdjg.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Windows\SysWOW64\mfcnbhr.exeC:\Windows\system32\mfcnbhr.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Windows\SysWOW64\snvalhal.exeC:\Windows\system32\snvalhal.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388 -
C:\Windows\SysWOW64\brwmeq.exeC:\Windows\system32\brwmeq.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Windows\SysWOW64\ofqiyfe.exeC:\Windows\system32\ofqiyfe.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\SysWOW64\gwqapej.exeC:\Windows\system32\gwqapej.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4892 -
C:\Windows\SysWOW64\wdnoryle.exeC:\Windows\system32\wdnoryle.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536 -
C:\Windows\SysWOW64\udptytb.exeC:\Windows\system32\udptytb.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\SysWOW64\bcyovl.exeC:\Windows\system32\bcyovl.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Windows\SysWOW64\cdhup.exeC:\Windows\system32\cdhup.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044 -
C:\Windows\SysWOW64\yqngqrp.exeC:\Windows\system32\yqngqrp.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068 -
C:\Windows\SysWOW64\hoacrr.exeC:\Windows\system32\hoacrr.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\SysWOW64\kzkji.exeC:\Windows\system32\kzkji.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088 -
C:\Windows\SysWOW64\vnqbi.exeC:\Windows\system32\vnqbi.exe39⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:620 -
C:\Windows\SysWOW64\hpkqgti.exeC:\Windows\system32\hpkqgti.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Windows\SysWOW64\vpnjeb.exeC:\Windows\system32\vpnjeb.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956 -
C:\Windows\SysWOW64\dmlpcc.exeC:\Windows\system32\dmlpcc.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\SysWOW64\hjzcuxik.exeC:\Windows\system32\hjzcuxik.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Windows\SysWOW64\moavpwpj.exeC:\Windows\system32\moavpwpj.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012 -
C:\Windows\SysWOW64\iqyogupe.exeC:\Windows\system32\iqyogupe.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5036 -
C:\Windows\SysWOW64\loazgn.exeC:\Windows\system32\loazgn.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760 -
C:\Windows\SysWOW64\royumig.exeC:\Windows\system32\royumig.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328 -
C:\Windows\SysWOW64\kwvhujq.exeC:\Windows\system32\kwvhujq.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492 -
C:\Windows\SysWOW64\rijmrgj.exeC:\Windows\system32\rijmrgj.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4752 -
C:\Windows\SysWOW64\pmiogg.exeC:\Windows\system32\pmiogg.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3872 -
C:\Windows\SysWOW64\cbpcs.exeC:\Windows\system32\cbpcs.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088 -
C:\Windows\SysWOW64\yywkohoq.exeC:\Windows\system32\yywkohoq.exe52⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\SysWOW64\rnjjp.exeC:\Windows\system32\rnjjp.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3312 -
C:\Windows\SysWOW64\bdqmtc.exeC:\Windows\system32\bdqmtc.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880 -
C:\Windows\SysWOW64\rnbwak.exeC:\Windows\system32\rnbwak.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292 -
C:\Windows\SysWOW64\vvpgrz.exeC:\Windows\system32\vvpgrz.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\rxidqpiw.exeC:\Windows\system32\rxidqpiw.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\SysWOW64\hfmrqdsd.exeC:\Windows\system32\hfmrqdsd.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016 -
C:\Windows\SysWOW64\jbgbh.exeC:\Windows\system32\jbgbh.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\SysWOW64\dygyack.exeC:\Windows\system32\dygyack.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2192 -
C:\Windows\SysWOW64\hwhglje.exeC:\Windows\system32\hwhglje.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804 -
C:\Windows\SysWOW64\cydpa.exeC:\Windows\system32\cydpa.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Windows\SysWOW64\ntnza.exeC:\Windows\system32\ntnza.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\SysWOW64\ddifxp.exeC:\Windows\system32\ddifxp.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060 -
C:\Windows\SysWOW64\rrrgxm.exeC:\Windows\system32\rrrgxm.exe65⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\dyydrg.exeC:\Windows\system32\dyydrg.exe66⤵PID:4148
-
C:\Windows\SysWOW64\bawfjzwz.exeC:\Windows\system32\bawfjzwz.exe67⤵PID:1176
-
C:\Windows\SysWOW64\bgqewnlq.exeC:\Windows\system32\bgqewnlq.exe68⤵PID:3696
-
C:\Windows\SysWOW64\snkkkkzf.exeC:\Windows\system32\snkkkkzf.exe69⤵PID:1764
-
C:\Windows\SysWOW64\gsckkp.exeC:\Windows\system32\gsckkp.exe70⤵PID:4048
-
C:\Windows\SysWOW64\uvmlz.exeC:\Windows\system32\uvmlz.exe71⤵PID:2972
-
C:\Windows\SysWOW64\wscbi.exeC:\Windows\system32\wscbi.exe72⤵PID:2416
-
C:\Windows\SysWOW64\yrlnkgs.exeC:\Windows\system32\yrlnkgs.exe73⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Windows\SysWOW64\tnbyag.exeC:\Windows\system32\tnbyag.exe74⤵
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\bgikcd.exeC:\Windows\system32\bgikcd.exe75⤵PID:4492
-
C:\Windows\SysWOW64\najqao.exeC:\Windows\system32\najqao.exe76⤵PID:452
-
C:\Windows\SysWOW64\ealvf.exeC:\Windows\system32\ealvf.exe77⤵PID:1184
-
C:\Windows\SysWOW64\vuxprctq.exeC:\Windows\system32\vuxprctq.exe78⤵PID:4868
-
C:\Windows\SysWOW64\rnyuk.exeC:\Windows\system32\rnyuk.exe79⤵PID:4832
-
C:\Windows\SysWOW64\sggrjgrw.exeC:\Windows\system32\sggrjgrw.exe80⤵PID:1992
-
C:\Windows\SysWOW64\mzvqsupx.exeC:\Windows\system32\mzvqsupx.exe81⤵PID:2368
-
C:\Windows\SysWOW64\pjdrs.exeC:\Windows\system32\pjdrs.exe82⤵PID:1280
-
C:\Windows\SysWOW64\yqcuni.exeC:\Windows\system32\yqcuni.exe83⤵PID:3016
-
C:\Windows\SysWOW64\yumtd.exeC:\Windows\system32\yumtd.exe84⤵PID:4332
-
C:\Windows\SysWOW64\oidmh.exeC:\Windows\system32\oidmh.exe85⤵PID:4696
-
C:\Windows\SysWOW64\vqiftiv.exeC:\Windows\system32\vqiftiv.exe86⤵
- Drops file in System32 directory
PID:4448 -
C:\Windows\SysWOW64\oebaspjs.exeC:\Windows\system32\oebaspjs.exe87⤵PID:4572
-
C:\Windows\SysWOW64\hqgerbm.exeC:\Windows\system32\hqgerbm.exe88⤵PID:3604
-
C:\Windows\SysWOW64\mzreshtr.exeC:\Windows\system32\mzreshtr.exe89⤵PID:1920
-
C:\Windows\SysWOW64\zzaylabl.exeC:\Windows\system32\zzaylabl.exe90⤵PID:5116
-
C:\Windows\SysWOW64\dkfvom.exeC:\Windows\system32\dkfvom.exe91⤵PID:884
-
C:\Windows\SysWOW64\vqebg.exeC:\Windows\system32\vqebg.exe92⤵PID:1776
-
C:\Windows\SysWOW64\ytyliugz.exeC:\Windows\system32\ytyliugz.exe93⤵PID:1480
-
C:\Windows\SysWOW64\coqytje.exeC:\Windows\system32\coqytje.exe94⤵PID:2584
-
C:\Windows\SysWOW64\xkdjmmc.exeC:\Windows\system32\xkdjmmc.exe95⤵PID:4364
-
C:\Windows\SysWOW64\cmsfterf.exeC:\Windows\system32\cmsfterf.exe96⤵PID:5132
-
C:\Windows\SysWOW64\elxwqdvk.exeC:\Windows\system32\elxwqdvk.exe97⤵PID:5160
-
C:\Windows\SysWOW64\eykagxri.exeC:\Windows\system32\eykagxri.exe98⤵PID:5196
-
C:\Windows\SysWOW64\ndyidg.exeC:\Windows\system32\ndyidg.exe99⤵PID:5220
-
C:\Windows\SysWOW64\seeyi.exeC:\Windows\system32\seeyi.exe100⤵PID:5244
-
C:\Windows\SysWOW64\hudblilg.exeC:\Windows\system32\hudblilg.exe101⤵PID:5272
-
C:\Windows\SysWOW64\yaskjrck.exeC:\Windows\system32\yaskjrck.exe102⤵PID:5296
-
C:\Windows\SysWOW64\rjgac.exeC:\Windows\system32\rjgac.exe103⤵PID:5320
-
C:\Windows\SysWOW64\luumq.exeC:\Windows\system32\luumq.exe104⤵PID:5344
-
C:\Windows\SysWOW64\pwovdca.exeC:\Windows\system32\pwovdca.exe105⤵PID:5372
-
C:\Windows\SysWOW64\dxrjvo.exeC:\Windows\system32\dxrjvo.exe106⤵PID:5396
-
C:\Windows\SysWOW64\kltvsl.exeC:\Windows\system32\kltvsl.exe107⤵PID:5424
-
C:\Windows\SysWOW64\ljncrz.exeC:\Windows\system32\ljncrz.exe108⤵PID:5448
-
C:\Windows\SysWOW64\gbovm.exeC:\Windows\system32\gbovm.exe109⤵PID:5488
-
C:\Windows\SysWOW64\gpmncvf.exeC:\Windows\system32\gpmncvf.exe110⤵PID:5512
-
C:\Windows\SysWOW64\frgpnqy.exeC:\Windows\system32\frgpnqy.exe111⤵PID:5552
-
C:\Windows\SysWOW64\tjvdr.exeC:\Windows\system32\tjvdr.exe112⤵PID:5576
-
C:\Windows\SysWOW64\xdjxz.exeC:\Windows\system32\xdjxz.exe113⤵PID:5600
-
C:\Windows\SysWOW64\lnioo.exeC:\Windows\system32\lnioo.exe114⤵PID:5628
-
C:\Windows\SysWOW64\huirbcr.exeC:\Windows\system32\huirbcr.exe115⤵PID:5652
-
C:\Windows\SysWOW64\zdahfi.exeC:\Windows\system32\zdahfi.exe116⤵PID:5680
-
C:\Windows\SysWOW64\secrcy.exeC:\Windows\system32\secrcy.exe117⤵PID:5704
-
C:\Windows\SysWOW64\mfewdbxk.exeC:\Windows\system32\mfewdbxk.exe118⤵PID:5744
-
C:\Windows\SysWOW64\otxdad.exeC:\Windows\system32\otxdad.exe119⤵PID:5776
-
C:\Windows\SysWOW64\caouh.exeC:\Windows\system32\caouh.exe120⤵PID:5800
-
C:\Windows\SysWOW64\uwvcka.exeC:\Windows\system32\uwvcka.exe121⤵PID:5824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-