Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
-
Size
278KB
-
MD5
c85b429975be01e19fbac6a0a44fbafd
-
SHA1
983de065f115e6557c143487897ea5d6feeb3471
-
SHA256
1b506518b6b946665917e07d80c89894f7e70d08780cb611049e46f329a43e12
-
SHA512
397b16b859081476fb9abe30ad113bacdcaf1812fdb73cc401da6e7a579f180bdf89eaf5d03f21dbc4ba6d80a90d57b04ec58b50c7e9df2793db1a856cfc3f74
-
SSDEEP
6144:UBycky5x57KKM6CRzMSx/2S3bwvP6bQ7yMP+DE827+Y:gkvKDsU6b7MP+Dd2SY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2804 lzxc.exe 2540 lzxc.exe 2860 ogdm.exe 3004 ogdm.exe 1660 qfpk.exe 1176 qfpk.exe 264 sasn.exe 2396 sasn.exe 664 hmph.exe 944 hmph.exe 316 ptca.exe 820 ptca.exe 1672 cvip.exe 2452 cvip.exe 992 mrja.exe 2484 mrja.exe 2960 wbyk.exe 2736 wbyk.exe 1736 gali.exe 2696 gali.exe 2604 tnuf.exe 2812 tnuf.exe 2888 bsek.exe 2224 bsek.exe 2832 nmka.exe 1900 nmka.exe 1300 xwak.exe 2568 xwak.exe 2244 kndn.exe 2028 kndn.exe 2300 xlxq.exe 1772 xlxq.exe 1436 kcst.exe 844 kcst.exe 944 uqti.exe 3012 uqti.exe 1584 hgol.exe 2468 hgol.exe 860 rnai.exe 2312 rnai.exe 2948 eevl.exe 1636 eevl.exe 2316 odhi.exe 2688 odhi.exe 2768 yows.exe 2872 yows.exe 2192 ijpl.exe 1788 ijpl.exe 2808 yril.exe 1976 yril.exe 1660 fkhy.exe 1792 fkhy.exe 2148 uwel.exe 548 uwel.exe 280 irnb.exe 664 irnb.exe 1652 rxoy.exe 1564 rxoy.exe 1152 esgo.exe 1236 esgo.exe 1836 ouvy.exe 1240 ouvy.exe 2276 bwbo.exe 1892 bwbo.exe -
Loads dropped DLL 64 IoCs
pid Process 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 2804 lzxc.exe 2540 lzxc.exe 2540 lzxc.exe 2860 ogdm.exe 3004 ogdm.exe 3004 ogdm.exe 1660 qfpk.exe 1176 qfpk.exe 1176 qfpk.exe 264 sasn.exe 2396 sasn.exe 2396 sasn.exe 944 hmph.exe 944 hmph.exe 820 ptca.exe 820 ptca.exe 2452 cvip.exe 2452 cvip.exe 2484 mrja.exe 2484 mrja.exe 2736 wbyk.exe 2736 wbyk.exe 2696 gali.exe 2696 gali.exe 2812 tnuf.exe 2812 tnuf.exe 2224 bsek.exe 2224 bsek.exe 1900 nmka.exe 1900 nmka.exe 2568 xwak.exe 2568 xwak.exe 2028 kndn.exe 2028 kndn.exe 1772 xlxq.exe 1772 xlxq.exe 844 kcst.exe 844 kcst.exe 3012 uqti.exe 3012 uqti.exe 2468 hgol.exe 2468 hgol.exe 2312 rnai.exe 2312 rnai.exe 1636 eevl.exe 1636 eevl.exe 2688 odhi.exe 2688 odhi.exe 2872 yows.exe 2872 yows.exe 1788 ijpl.exe 1788 ijpl.exe 1976 yril.exe 1976 yril.exe 1792 fkhy.exe 1792 fkhy.exe 548 uwel.exe 548 uwel.exe 664 irnb.exe 664 irnb.exe 1564 rxoy.exe 1564 rxoy.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 oier.exe File opened for modification \??\PhysicalDrive0 jqft.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 ppzx.exe File opened for modification \??\PhysicalDrive0 flfh.exe File opened for modification \??\PhysicalDrive0 jnjf.exe File opened for modification \??\PhysicalDrive0 gpsb.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 lzao.exe File opened for modification \??\PhysicalDrive0 poud.exe File opened for modification \??\PhysicalDrive0 yfah.exe File opened for modification \??\PhysicalDrive0 scak.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 dqnn.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 slxt.exe File opened for modification \??\PhysicalDrive0 aunh.exe File opened for modification \??\PhysicalDrive0 ynkj.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 fvqb.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 hgol.exe File opened for modification \??\PhysicalDrive0 whro.exe File opened for modification \??\PhysicalDrive0 gdqj.exe File opened for modification \??\PhysicalDrive0 hdyc.exe File opened for modification \??\PhysicalDrive0 qshg.exe File opened for modification \??\PhysicalDrive0 yvjz.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 enfj.exe File opened for modification \??\PhysicalDrive0 fqrb.exe File opened for modification \??\PhysicalDrive0 ysyq.exe File opened for modification \??\PhysicalDrive0 blaa.exe File opened for modification \??\PhysicalDrive0 ukyv.exe File opened for modification \??\PhysicalDrive0 rxlz.exe File opened for modification \??\PhysicalDrive0 dztd.exe File opened for modification \??\PhysicalDrive0 pzko.exe File opened for modification \??\PhysicalDrive0 ngrl.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 djkj.exe File opened for modification \??\PhysicalDrive0 dbpi.exe File opened for modification \??\PhysicalDrive0 guxo.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 msgc.exe File opened for modification \??\PhysicalDrive0 wdnt.exe File opened for modification \??\PhysicalDrive0 chyl.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 pewd.exe File opened for modification \??\PhysicalDrive0 wvat.exe File opened for modification \??\PhysicalDrive0 fnnq.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 sldx.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sque.exe gwox.exe File created C:\Windows\SysWOW64\ywjs.exe oxxv.exe File opened for modification C:\Windows\SysWOW64\uxkv.exe igps.exe File created C:\Windows\SysWOW64\dgze.exe Process not Found File created C:\Windows\SysWOW64\qufw.exe Process not Found File created C:\Windows\SysWOW64\cotw.exe Process not Found File created C:\Windows\SysWOW64\pcbo.exe clgl.exe File created C:\Windows\SysWOW64\ilce.exe vvhb.exe File opened for modification C:\Windows\SysWOW64\ersz.exe rtyw.exe File created C:\Windows\SysWOW64\witt.exe jkrq.exe File opened for modification C:\Windows\SysWOW64\qelo.exe gqky.exe File created C:\Windows\SysWOW64\noyt.exe Process not Found File opened for modification C:\Windows\SysWOW64\poud.exe cqra.exe File opened for modification C:\Windows\SysWOW64\obne.exe ckkb.exe File opened for modification C:\Windows\SysWOW64\xigi.exe ksln.exe File created C:\Windows\SysWOW64\jzmr.exe apoh.exe File opened for modification C:\Windows\SysWOW64\jnjf.exe xtdp.exe File opened for modification C:\Windows\SysWOW64\wvwt.exe Process not Found File opened for modification C:\Windows\SysWOW64\hgol.exe uqti.exe File created C:\Windows\SysWOW64\tmew.exe gnbt.exe File opened for modification C:\Windows\SysWOW64\blum.exe nydx.exe File created C:\Windows\SysWOW64\guxo.exe xgwq.exe File created C:\Windows\SysWOW64\wkmr.exe Process not Found File created C:\Windows\SysWOW64\zfbz.exe pumo.exe File opened for modification C:\Windows\SysWOW64\kcym.exe boyp.exe File opened for modification C:\Windows\SysWOW64\bbtd.exe rqda.exe File created C:\Windows\SysWOW64\htja.exe Process not Found File created C:\Windows\SysWOW64\hgol.exe uqti.exe File created C:\Windows\SysWOW64\nsik.exe aunh.exe File created C:\Windows\SysWOW64\qzwn.exe djbt.exe File created C:\Windows\SysWOW64\ftyk.exe vfxn.exe File opened for modification C:\Windows\SysWOW64\jntu.exe Process not Found File opened for modification C:\Windows\SysWOW64\hndb.exe Process not Found File created C:\Windows\SysWOW64\cwez.exe pcqk.exe File opened for modification C:\Windows\SysWOW64\kytm.exe yaqj.exe File created C:\Windows\SysWOW64\vuvd.exe Process not Found File opened for modification C:\Windows\SysWOW64\qmog.exe Process not Found File opened for modification C:\Windows\SysWOW64\hhsd.exe Process not Found File created C:\Windows\SysWOW64\hmtd.exe Process not Found File created C:\Windows\SysWOW64\jmiq.exe wsci.exe File opened for modification C:\Windows\SysWOW64\rrya.exe hdyc.exe File created C:\Windows\SysWOW64\vdpf.exe Process not Found File created C:\Windows\SysWOW64\wcwk.exe jmbi.exe File opened for modification C:\Windows\SysWOW64\ydza.exe opyl.exe File opened for modification C:\Windows\SysWOW64\pjxp.exe Process not Found File created C:\Windows\SysWOW64\ieaa.exe Process not Found File created C:\Windows\SysWOW64\yseo.exe Process not Found File opened for modification C:\Windows\SysWOW64\ppin.exe cznk.exe File opened for modification C:\Windows\SysWOW64\gvaj.exe ubut.exe File opened for modification C:\Windows\SysWOW64\nhwj.exe dfhy.exe File opened for modification C:\Windows\SysWOW64\xrht.exe kepv.exe File opened for modification C:\Windows\SysWOW64\pcqk.exe cphu.exe File opened for modification C:\Windows\SysWOW64\fypj.exe slxt.exe File opened for modification C:\Windows\SysWOW64\lsdu.exe bqoj.exe File opened for modification C:\Windows\SysWOW64\edbe.exe rfgb.exe File opened for modification C:\Windows\SysWOW64\bcpn.exe oajf.exe File created C:\Windows\SysWOW64\jsut.exe Process not Found File opened for modification C:\Windows\SysWOW64\iylh.exe Process not Found File created C:\Windows\SysWOW64\vqsr.exe jomb.exe File opened for modification C:\Windows\SysWOW64\argh.exe qorw.exe File created C:\Windows\SysWOW64\vffx.exe Process not Found File opened for modification C:\Windows\SysWOW64\jewe.exe wobb.exe File opened for modification C:\Windows\SysWOW64\rosh.exe eqxe.exe File created C:\Windows\SysWOW64\bhaj.exe rxlz.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2236 set thread context of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2804 set thread context of 2540 2804 lzxc.exe 32 PID 2860 set thread context of 3004 2860 ogdm.exe 34 PID 1660 set thread context of 1176 1660 qfpk.exe 36 PID 264 set thread context of 2396 264 sasn.exe 38 PID 664 set thread context of 944 664 hmph.exe 40 PID 316 set thread context of 820 316 ptca.exe 42 PID 1672 set thread context of 2452 1672 cvip.exe 44 PID 992 set thread context of 2484 992 mrja.exe 46 PID 2960 set thread context of 2736 2960 wbyk.exe 48 PID 1736 set thread context of 2696 1736 gali.exe 50 PID 2604 set thread context of 2812 2604 tnuf.exe 52 PID 2888 set thread context of 2224 2888 bsek.exe 54 PID 2832 set thread context of 1900 2832 nmka.exe 56 PID 1300 set thread context of 2568 1300 xwak.exe 58 PID 2244 set thread context of 2028 2244 kndn.exe 60 PID 2300 set thread context of 1772 2300 xlxq.exe 62 PID 1436 set thread context of 844 1436 kcst.exe 64 PID 944 set thread context of 3012 944 uqti.exe 66 PID 1584 set thread context of 2468 1584 hgol.exe 68 PID 860 set thread context of 2312 860 rnai.exe 70 PID 2948 set thread context of 1636 2948 eevl.exe 72 PID 2316 set thread context of 2688 2316 odhi.exe 74 PID 2768 set thread context of 2872 2768 yows.exe 76 PID 2192 set thread context of 1788 2192 ijpl.exe 78 PID 2808 set thread context of 1976 2808 yril.exe 80 PID 1660 set thread context of 1792 1660 fkhy.exe 82 PID 2148 set thread context of 548 2148 uwel.exe 84 PID 280 set thread context of 664 280 irnb.exe 86 PID 1652 set thread context of 1564 1652 rxoy.exe 88 PID 1152 set thread context of 1236 1152 esgo.exe 90 PID 1836 set thread context of 1240 1836 ouvy.exe 92 PID 2276 set thread context of 1892 2276 bwbo.exe 94 PID 2652 set thread context of 2484 2652 ojtd.exe 96 PID 2532 set thread context of 2124 2532 bang.exe 98 PID 2884 set thread context of 2880 2884 nffb.exe 100 PID 376 set thread context of 2896 376 yejy.exe 102 PID 2080 set thread context of 1576 2080 lzao.exe 104 PID 1524 set thread context of 1500 1524 vcqy.exe 106 PID 980 set thread context of 2416 980 enfj.exe 108 PID 1048 set thread context of 2396 1048 saxy.exe 110 PID 968 set thread context of 2076 968 fqrb.exe 112 PID 3008 set thread context of 1568 3008 obhm.exe 114 PID 1572 set thread context of 1992 1572 bvnb.exe 116 PID 2236 set thread context of 2168 2236 oier.exe 118 PID 1932 set thread context of 2652 1932 ywfo.exe 120 PID 2748 set thread context of 2536 2748 luar.exe 122 PID 2864 set thread context of 1128 2864 yhrh.exe 124 PID 3012 set thread context of 2600 3012 lbyw.exe 126 PID 2820 set thread context of 1764 2820 vmnz.exe 128 PID 484 set thread context of 1552 484 zcib.exe 130 PID 2244 set thread context of 980 2244 meor.exe 132 PID 1768 set thread context of 1048 1768 zrfh.exe 134 PID 1000 set thread context of 968 1000 jfge.exe 136 PID 896 set thread context of 820 896 wwbh.exe 138 PID 1836 set thread context of 2464 1836 jrsx.exe 140 PID 2992 set thread context of 864 2992 wlym.exe 142 PID 2724 set thread context of 1932 2724 gwox.exe 144 PID 2776 set thread context of 2748 2776 sque.exe 146 PID 2892 set thread context of 1636 2892 fllu.exe 148 PID 1640 set thread context of 2688 1640 sbgx.exe 150 PID 2808 set thread context of 2872 2808 cphu.exe 152 PID 764 set thread context of 1576 764 pcqk.exe 154 PID 1204 set thread context of 1500 1204 cwez.exe 156 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cphu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kzjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fitt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsud.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language agwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wdnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rzrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pqca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cipm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language saxy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ittu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ohku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eulp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oysi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lisb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ozrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jewe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ujbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsdu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language akuo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oydm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uxkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eoxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ittu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opyl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mrja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cgua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language udnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gqwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ujhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language egqw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qssk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nikc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sfwy.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ lxpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ xrht.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key ngrl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" wuug.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key cjlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ zrua.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" zgkf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key wobk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key aeqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" bqoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key lnev.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key qbwt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" nikc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ bcpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ovji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ juku.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" bshn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key vvbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ slrh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key oydm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ gpsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ gyax.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key zxcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" cqcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ucid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key srcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key biqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key prus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key slxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" qzrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" ywjs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ehls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key mtap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ witt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" xiru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ cjlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" oilc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key pzko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ hril.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ sasn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key hgol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key rxoy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" hfky.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key jsmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key qged.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" hblh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" swjv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" hril.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2236 wrote to memory of 2680 2236 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2804 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 31 PID 2680 wrote to memory of 2804 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 31 PID 2680 wrote to memory of 2804 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 31 PID 2680 wrote to memory of 2804 2680 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 31 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2804 wrote to memory of 2540 2804 lzxc.exe 32 PID 2540 wrote to memory of 2860 2540 lzxc.exe 33 PID 2540 wrote to memory of 2860 2540 lzxc.exe 33 PID 2540 wrote to memory of 2860 2540 lzxc.exe 33 PID 2540 wrote to memory of 2860 2540 lzxc.exe 33 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 2860 wrote to memory of 3004 2860 ogdm.exe 34 PID 3004 wrote to memory of 1660 3004 ogdm.exe 35 PID 3004 wrote to memory of 1660 3004 ogdm.exe 35 PID 3004 wrote to memory of 1660 3004 ogdm.exe 35 PID 3004 wrote to memory of 1660 3004 ogdm.exe 35 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1660 wrote to memory of 1176 1660 qfpk.exe 36 PID 1176 wrote to memory of 264 1176 qfpk.exe 37 PID 1176 wrote to memory of 264 1176 qfpk.exe 37 PID 1176 wrote to memory of 264 1176 qfpk.exe 37 PID 1176 wrote to memory of 264 1176 qfpk.exe 37 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 264 wrote to memory of 2396 264 sasn.exe 38 PID 2396 wrote to memory of 664 2396 sasn.exe 39 PID 2396 wrote to memory of 664 2396 sasn.exe 39 PID 2396 wrote to memory of 664 2396 sasn.exe 39 PID 2396 wrote to memory of 664 2396 sasn.exe 39 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 664 wrote to memory of 944 664 hmph.exe 40 PID 944 wrote to memory of 316 944 hmph.exe 41 PID 944 wrote to memory of 316 944 hmph.exe 41 PID 944 wrote to memory of 316 944 hmph.exe 41 PID 944 wrote to memory of 316 944 hmph.exe 41 PID 316 wrote to memory of 820 316 ptca.exe 42 PID 316 wrote to memory of 820 316 ptca.exe 42 PID 316 wrote to memory of 820 316 ptca.exe 42 PID 316 wrote to memory of 820 316 ptca.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\lzxc.exeC:\Windows\system32\lzxc.exe 500 "C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\lzxc.exeC:\Windows\SysWOW64\lzxc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\ogdm.exeC:\Windows\system32\ogdm.exe 460 "C:\Windows\SysWOW64\lzxc.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\ogdm.exeC:\Windows\SysWOW64\ogdm.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\qfpk.exeC:\Windows\system32\qfpk.exe 456 "C:\Windows\SysWOW64\ogdm.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\qfpk.exeC:\Windows\SysWOW64\qfpk.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\sasn.exeC:\Windows\system32\sasn.exe 456 "C:\Windows\SysWOW64\qfpk.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\sasn.exeC:\Windows\SysWOW64\sasn.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\hmph.exeC:\Windows\system32\hmph.exe 536 "C:\Windows\SysWOW64\sasn.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\hmph.exeC:\Windows\SysWOW64\hmph.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\ptca.exeC:\Windows\system32\ptca.exe 540 "C:\Windows\SysWOW64\hmph.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\ptca.exeC:\Windows\SysWOW64\ptca.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Windows\SysWOW64\cvip.exeC:\Windows\system32\cvip.exe 540 "C:\Windows\SysWOW64\ptca.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1672 -
C:\Windows\SysWOW64\cvip.exeC:\Windows\SysWOW64\cvip.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Windows\SysWOW64\mrja.exeC:\Windows\system32\mrja.exe 536 "C:\Windows\SysWOW64\cvip.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\mrja.exeC:\Windows\SysWOW64\mrja.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Windows\SysWOW64\wbyk.exeC:\Windows\system32\wbyk.exe 540 "C:\Windows\SysWOW64\mrja.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2960 -
C:\Windows\SysWOW64\wbyk.exeC:\Windows\SysWOW64\wbyk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Windows\SysWOW64\gali.exeC:\Windows\system32\gali.exe 536 "C:\Windows\SysWOW64\wbyk.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1736 -
C:\Windows\SysWOW64\gali.exeC:\Windows\SysWOW64\gali.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\tnuf.exeC:\Windows\system32\tnuf.exe 472 "C:\Windows\SysWOW64\gali.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2604 -
C:\Windows\SysWOW64\tnuf.exeC:\Windows\SysWOW64\tnuf.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\bsek.exeC:\Windows\system32\bsek.exe 552 "C:\Windows\SysWOW64\tnuf.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2888 -
C:\Windows\SysWOW64\bsek.exeC:\Windows\SysWOW64\bsek.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Windows\SysWOW64\nmka.exeC:\Windows\system32\nmka.exe 536 "C:\Windows\SysWOW64\bsek.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2832 -
C:\Windows\SysWOW64\nmka.exeC:\Windows\SysWOW64\nmka.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Windows\SysWOW64\xwak.exeC:\Windows\system32\xwak.exe 540 "C:\Windows\SysWOW64\nmka.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1300 -
C:\Windows\SysWOW64\xwak.exeC:\Windows\SysWOW64\xwak.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Windows\SysWOW64\kndn.exeC:\Windows\system32\kndn.exe 536 "C:\Windows\SysWOW64\xwak.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\SysWOW64\kndn.exeC:\Windows\SysWOW64\kndn.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Windows\SysWOW64\xlxq.exeC:\Windows\system32\xlxq.exe 548 "C:\Windows\SysWOW64\kndn.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300 -
C:\Windows\SysWOW64\xlxq.exeC:\Windows\SysWOW64\xlxq.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Windows\SysWOW64\kcst.exeC:\Windows\system32\kcst.exe 536 "C:\Windows\SysWOW64\xlxq.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1436 -
C:\Windows\SysWOW64\kcst.exeC:\Windows\SysWOW64\kcst.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Windows\SysWOW64\uqti.exeC:\Windows\system32\uqti.exe 548 "C:\Windows\SysWOW64\kcst.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:944 -
C:\Windows\SysWOW64\uqti.exeC:\Windows\SysWOW64\uqti.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\hgol.exeC:\Windows\system32\hgol.exe 548 "C:\Windows\SysWOW64\uqti.exe"39⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1584 -
C:\Windows\SysWOW64\hgol.exeC:\Windows\SysWOW64\hgol.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Windows\SysWOW64\rnai.exeC:\Windows\system32\rnai.exe 536 "C:\Windows\SysWOW64\hgol.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:860 -
C:\Windows\SysWOW64\rnai.exeC:\Windows\SysWOW64\rnai.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Windows\SysWOW64\eevl.exeC:\Windows\system32\eevl.exe 544 "C:\Windows\SysWOW64\rnai.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2948 -
C:\Windows\SysWOW64\eevl.exeC:\Windows\SysWOW64\eevl.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Windows\SysWOW64\odhi.exeC:\Windows\system32\odhi.exe 532 "C:\Windows\SysWOW64\eevl.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2316 -
C:\Windows\SysWOW64\odhi.exeC:\Windows\SysWOW64\odhi.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\yows.exeC:\Windows\system32\yows.exe 540 "C:\Windows\SysWOW64\odhi.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2768 -
C:\Windows\SysWOW64\yows.exeC:\Windows\SysWOW64\yows.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\ijpl.exeC:\Windows\system32\ijpl.exe 544 "C:\Windows\SysWOW64\yows.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192 -
C:\Windows\SysWOW64\ijpl.exeC:\Windows\SysWOW64\ijpl.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\yril.exeC:\Windows\system32\yril.exe 540 "C:\Windows\SysWOW64\ijpl.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2808 -
C:\Windows\SysWOW64\yril.exeC:\Windows\SysWOW64\yril.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Windows\SysWOW64\fkhy.exeC:\Windows\system32\fkhy.exe 536 "C:\Windows\SysWOW64\yril.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1660 -
C:\Windows\SysWOW64\fkhy.exeC:\Windows\SysWOW64\fkhy.exe54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Windows\SysWOW64\uwel.exeC:\Windows\system32\uwel.exe 536 "C:\Windows\SysWOW64\fkhy.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2148 -
C:\Windows\SysWOW64\uwel.exeC:\Windows\SysWOW64\uwel.exe56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Windows\SysWOW64\irnb.exeC:\Windows\system32\irnb.exe 532 "C:\Windows\SysWOW64\uwel.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:280 -
C:\Windows\SysWOW64\irnb.exeC:\Windows\SysWOW64\irnb.exe58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Windows\SysWOW64\rxoy.exeC:\Windows\system32\rxoy.exe 536 "C:\Windows\SysWOW64\irnb.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\rxoy.exeC:\Windows\SysWOW64\rxoy.exe60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Windows\SysWOW64\esgo.exeC:\Windows\system32\esgo.exe 536 "C:\Windows\SysWOW64\rxoy.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1152 -
C:\Windows\SysWOW64\esgo.exeC:\Windows\SysWOW64\esgo.exe62⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\ouvy.exeC:\Windows\system32\ouvy.exe 532 "C:\Windows\SysWOW64\esgo.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
C:\Windows\SysWOW64\ouvy.exeC:\Windows\SysWOW64\ouvy.exe64⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\bwbo.exeC:\Windows\system32\bwbo.exe 544 "C:\Windows\SysWOW64\ouvy.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2276 -
C:\Windows\SysWOW64\bwbo.exeC:\Windows\SysWOW64\bwbo.exe66⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\ojtd.exeC:\Windows\system32\ojtd.exe 544 "C:\Windows\SysWOW64\bwbo.exe"67⤵
- Suspicious use of SetThreadContext
PID:2652 -
C:\Windows\SysWOW64\ojtd.exeC:\Windows\SysWOW64\ojtd.exe68⤵PID:2484
-
C:\Windows\SysWOW64\bang.exeC:\Windows\system32\bang.exe 540 "C:\Windows\SysWOW64\ojtd.exe"69⤵
- Suspicious use of SetThreadContext
PID:2532 -
C:\Windows\SysWOW64\bang.exeC:\Windows\SysWOW64\bang.exe70⤵PID:2124
-
C:\Windows\SysWOW64\nffb.exeC:\Windows\system32\nffb.exe 552 "C:\Windows\SysWOW64\bang.exe"71⤵
- Suspicious use of SetThreadContext
PID:2884 -
C:\Windows\SysWOW64\nffb.exeC:\Windows\SysWOW64\nffb.exe72⤵PID:2880
-
C:\Windows\SysWOW64\yejy.exeC:\Windows\system32\yejy.exe 536 "C:\Windows\SysWOW64\nffb.exe"73⤵
- Suspicious use of SetThreadContext
PID:376 -
C:\Windows\SysWOW64\yejy.exeC:\Windows\SysWOW64\yejy.exe74⤵PID:2896
-
C:\Windows\SysWOW64\lzao.exeC:\Windows\system32\lzao.exe 548 "C:\Windows\SysWOW64\yejy.exe"75⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
PID:2080 -
C:\Windows\SysWOW64\lzao.exeC:\Windows\SysWOW64\lzao.exe76⤵PID:1576
-
C:\Windows\SysWOW64\vcqy.exeC:\Windows\system32\vcqy.exe 536 "C:\Windows\SysWOW64\lzao.exe"77⤵
- Suspicious use of SetThreadContext
PID:1524 -
C:\Windows\SysWOW64\vcqy.exeC:\Windows\SysWOW64\vcqy.exe78⤵PID:1500
-
C:\Windows\SysWOW64\enfj.exeC:\Windows\system32\enfj.exe 552 "C:\Windows\SysWOW64\vcqy.exe"79⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
PID:980 -
C:\Windows\SysWOW64\enfj.exeC:\Windows\SysWOW64\enfj.exe80⤵PID:2416
-
C:\Windows\SysWOW64\saxy.exeC:\Windows\system32\saxy.exe 540 "C:\Windows\SysWOW64\enfj.exe"81⤵
- Suspicious use of SetThreadContext
PID:1048 -
C:\Windows\SysWOW64\saxy.exeC:\Windows\SysWOW64\saxy.exe82⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\fqrb.exeC:\Windows\system32\fqrb.exe 536 "C:\Windows\SysWOW64\saxy.exe"83⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
PID:968 -
C:\Windows\SysWOW64\fqrb.exeC:\Windows\SysWOW64\fqrb.exe84⤵PID:2076
-
C:\Windows\SysWOW64\obhm.exeC:\Windows\system32\obhm.exe 536 "C:\Windows\SysWOW64\fqrb.exe"85⤵
- Suspicious use of SetThreadContext
PID:3008 -
C:\Windows\SysWOW64\obhm.exeC:\Windows\SysWOW64\obhm.exe86⤵PID:1568
-
C:\Windows\SysWOW64\bvnb.exeC:\Windows\system32\bvnb.exe 540 "C:\Windows\SysWOW64\obhm.exe"87⤵
- Suspicious use of SetThreadContext
PID:1572 -
C:\Windows\SysWOW64\bvnb.exeC:\Windows\SysWOW64\bvnb.exe88⤵PID:1992
-
C:\Windows\SysWOW64\oier.exeC:\Windows\system32\oier.exe 536 "C:\Windows\SysWOW64\bvnb.exe"89⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
PID:2236 -
C:\Windows\SysWOW64\oier.exeC:\Windows\SysWOW64\oier.exe90⤵PID:2168
-
C:\Windows\SysWOW64\ywfo.exeC:\Windows\system32\ywfo.exe 536 "C:\Windows\SysWOW64\oier.exe"91⤵
- Suspicious use of SetThreadContext
PID:1932 -
C:\Windows\SysWOW64\ywfo.exeC:\Windows\SysWOW64\ywfo.exe92⤵PID:2652
-
C:\Windows\SysWOW64\luar.exeC:\Windows\system32\luar.exe 536 "C:\Windows\SysWOW64\ywfo.exe"93⤵
- Suspicious use of SetThreadContext
PID:2748 -
C:\Windows\SysWOW64\luar.exeC:\Windows\SysWOW64\luar.exe94⤵PID:2536
-
C:\Windows\SysWOW64\yhrh.exeC:\Windows\system32\yhrh.exe 540 "C:\Windows\SysWOW64\luar.exe"95⤵
- Suspicious use of SetThreadContext
PID:2864 -
C:\Windows\SysWOW64\yhrh.exeC:\Windows\SysWOW64\yhrh.exe96⤵PID:1128
-
C:\Windows\SysWOW64\lbyw.exeC:\Windows\system32\lbyw.exe 544 "C:\Windows\SysWOW64\yhrh.exe"97⤵
- Suspicious use of SetThreadContext
PID:3012 -
C:\Windows\SysWOW64\lbyw.exeC:\Windows\SysWOW64\lbyw.exe98⤵PID:2600
-
C:\Windows\SysWOW64\vmnz.exeC:\Windows\system32\vmnz.exe 544 "C:\Windows\SysWOW64\lbyw.exe"99⤵
- Suspicious use of SetThreadContext
PID:2820 -
C:\Windows\SysWOW64\vmnz.exeC:\Windows\SysWOW64\vmnz.exe100⤵PID:1764
-
C:\Windows\SysWOW64\zcib.exeC:\Windows\system32\zcib.exe 548 "C:\Windows\SysWOW64\vmnz.exe"101⤵
- Suspicious use of SetThreadContext
PID:484 -
C:\Windows\SysWOW64\zcib.exeC:\Windows\SysWOW64\zcib.exe102⤵PID:1552
-
C:\Windows\SysWOW64\meor.exeC:\Windows\system32\meor.exe 544 "C:\Windows\SysWOW64\zcib.exe"103⤵
- Suspicious use of SetThreadContext
PID:2244 -
C:\Windows\SysWOW64\meor.exeC:\Windows\SysWOW64\meor.exe104⤵PID:980
-
C:\Windows\SysWOW64\zrfh.exeC:\Windows\system32\zrfh.exe 536 "C:\Windows\SysWOW64\meor.exe"105⤵
- Suspicious use of SetThreadContext
PID:1768 -
C:\Windows\SysWOW64\zrfh.exeC:\Windows\SysWOW64\zrfh.exe106⤵PID:1048
-
C:\Windows\SysWOW64\jfge.exeC:\Windows\system32\jfge.exe 544 "C:\Windows\SysWOW64\zrfh.exe"107⤵
- Suspicious use of SetThreadContext
PID:1000 -
C:\Windows\SysWOW64\jfge.exeC:\Windows\SysWOW64\jfge.exe108⤵PID:968
-
C:\Windows\SysWOW64\wwbh.exeC:\Windows\system32\wwbh.exe 540 "C:\Windows\SysWOW64\jfge.exe"109⤵
- Suspicious use of SetThreadContext
PID:896 -
C:\Windows\SysWOW64\wwbh.exeC:\Windows\SysWOW64\wwbh.exe110⤵PID:820
-
C:\Windows\SysWOW64\jrsx.exeC:\Windows\system32\jrsx.exe 548 "C:\Windows\SysWOW64\wwbh.exe"111⤵
- Suspicious use of SetThreadContext
PID:1836 -
C:\Windows\SysWOW64\jrsx.exeC:\Windows\SysWOW64\jrsx.exe112⤵PID:2464
-
C:\Windows\SysWOW64\wlym.exeC:\Windows\system32\wlym.exe 548 "C:\Windows\SysWOW64\jrsx.exe"113⤵
- Suspicious use of SetThreadContext
PID:2992 -
C:\Windows\SysWOW64\wlym.exeC:\Windows\SysWOW64\wlym.exe114⤵PID:864
-
C:\Windows\SysWOW64\gwox.exeC:\Windows\system32\gwox.exe 540 "C:\Windows\SysWOW64\wlym.exe"115⤵
- Suspicious use of SetThreadContext
PID:2724 -
C:\Windows\SysWOW64\gwox.exeC:\Windows\SysWOW64\gwox.exe116⤵
- Drops file in System32 directory
PID:1932 -
C:\Windows\SysWOW64\sque.exeC:\Windows\system32\sque.exe 536 "C:\Windows\SysWOW64\gwox.exe"117⤵
- Suspicious use of SetThreadContext
PID:2776 -
C:\Windows\SysWOW64\sque.exeC:\Windows\SysWOW64\sque.exe118⤵PID:2748
-
C:\Windows\SysWOW64\fllu.exeC:\Windows\system32\fllu.exe 536 "C:\Windows\SysWOW64\sque.exe"119⤵
- Suspicious use of SetThreadContext
PID:2892 -
C:\Windows\SysWOW64\fllu.exeC:\Windows\SysWOW64\fllu.exe120⤵PID:1636
-
C:\Windows\SysWOW64\sbgx.exeC:\Windows\system32\sbgx.exe 532 "C:\Windows\SysWOW64\fllu.exe"121⤵
- Suspicious use of SetThreadContext
PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-