Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe
-
Size
278KB
-
MD5
c85b429975be01e19fbac6a0a44fbafd
-
SHA1
983de065f115e6557c143487897ea5d6feeb3471
-
SHA256
1b506518b6b946665917e07d80c89894f7e70d08780cb611049e46f329a43e12
-
SHA512
397b16b859081476fb9abe30ad113bacdcaf1812fdb73cc401da6e7a579f180bdf89eaf5d03f21dbc4ba6d80a90d57b04ec58b50c7e9df2793db1a856cfc3f74
-
SSDEEP
6144:UBycky5x57KKM6CRzMSx/2S3bwvP6bQ7yMP+DE827+Y:gkvKDsU6b7MP+Dd2SY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3028 vlqm.exe 3460 vlqm.exe 3040 brvu.exe 3232 brvu.exe 512 ltke.exe 3328 ltke.exe 3832 dtls.exe 2020 dtls.exe 4004 naxp.exe 556 naxp.exe 2204 anhf.exe 3756 anhf.exe 3504 nayv.exe 2552 nayv.exe 2684 yzcs.exe 624 yzcs.exe 212 lmui.exe 716 lmui.exe 2128 ylpk.exe 1976 ylpk.exe 4284 ikbq.exe 2944 ikbq.exe 3692 yobd.exe 3700 yobd.exe 4528 gpad.exe 2532 gpad.exe 1832 vxml.exe 4224 vxml.exe 3460 feyi.exe 1860 feyi.exe 4556 vjyd.exe 1792 vjyd.exe 864 ftno.exe 4328 ftno.exe 1720 tvuy.exe 4720 tvuy.exe 4536 dfrb.exe 4092 dfrb.exe 2892 nbkt.exe 872 nbkt.exe 2472 aobj.exe 3564 aobj.exe 3284 nblz.exe 5092 nblz.exe 3444 azob.exe 1320 azob.exe 4808 nqje.exe 4800 nqje.exe 1212 adau.exe 4924 adau.exe 1812 kker.exe 1204 kker.exe 2320 yxwp.exe 4764 yxwp.exe 3264 lkff.exe 2072 lkff.exe 2688 yxxu.exe 3556 yxxu.exe 4024 ihmf.exe 1720 ihmf.exe 1620 vueu.exe 408 vueu.exe 1564 ihnk.exe 4104 ihnk.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aobj.exe nbkt.exe File created C:\Windows\SysWOW64\xvlo.exe nwhr.exe File opened for modification C:\Windows\SysWOW64\eagk.exe rnpu.exe File opened for modification C:\Windows\SysWOW64\oonf.exe Process not Found File opened for modification C:\Windows\SysWOW64\yobd.exe ikbq.exe File created C:\Windows\SysWOW64\kdzz.exe zhgg.exe File opened for modification C:\Windows\SysWOW64\uhhh.exe hqme.exe File opened for modification C:\Windows\SysWOW64\becs.exe ofhq.exe File opened for modification C:\Windows\SysWOW64\davj.exe rjbg.exe File opened for modification C:\Windows\SysWOW64\pzkq.exe eagk.exe File created C:\Windows\SysWOW64\nzou.exe amee.exe File opened for modification C:\Windows\SysWOW64\nxet.exe acmd.exe File created C:\Windows\SysWOW64\ksyj.exe xtdh.exe File created C:\Windows\SysWOW64\fouk.exe sxrh.exe File created C:\Windows\SysWOW64\bwds.exe ofip.exe File created C:\Windows\SysWOW64\mbgi.exe Process not Found File created C:\Windows\SysWOW64\vaop.exe Process not Found File opened for modification C:\Windows\SysWOW64\yzcs.exe nayv.exe File opened for modification C:\Windows\SysWOW64\zkfi.exe mtkf.exe File opened for modification C:\Windows\SysWOW64\ykaz.exe Process not Found File created C:\Windows\SysWOW64\vuyc.exe Process not Found File opened for modification C:\Windows\SysWOW64\vlqm.exe c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe File created C:\Windows\SysWOW64\uhlm.exe gyej.exe File created C:\Windows\SysWOW64\zrly.exe mifn.exe File created C:\Windows\SysWOW64\tnyh.exe rryp.exe File created C:\Windows\SysWOW64\iiss.exe Process not Found File opened for modification C:\Windows\SysWOW64\pykz.exe capx.exe File created C:\Windows\SysWOW64\rifs.exe evou.exe File created C:\Windows\SysWOW64\qgjl.exe Process not Found File created C:\Windows\SysWOW64\xtfd.exe nxet.exe File opened for modification C:\Windows\SysWOW64\pcxs.exe clcx.exe File created C:\Windows\SysWOW64\hpbe.exe ucso.exe File opened for modification C:\Windows\SysWOW64\lrzc.exe ybez.exe File opened for modification C:\Windows\SysWOW64\napw.exe anxg.exe File opened for modification C:\Windows\SysWOW64\imzs.exe Process not Found File opened for modification C:\Windows\SysWOW64\nxsw.exe Process not Found File created C:\Windows\SysWOW64\ikbq.exe ylpk.exe File created C:\Windows\SysWOW64\fyca.exe pxns.exe File created C:\Windows\SysWOW64\aifb.exe pmmq.exe File created C:\Windows\SysWOW64\hzdw.exe tmug.exe File opened for modification C:\Windows\SysWOW64\bmck.exe ozku.exe File opened for modification C:\Windows\SysWOW64\moyo.exe ctfd.exe File created C:\Windows\SysWOW64\tnqy.exe Process not Found File created C:\Windows\SysWOW64\sopx.exe iola.exe File opened for modification C:\Windows\SysWOW64\klkg.exe xqsr.exe File opened for modification C:\Windows\SysWOW64\iuen.exe sqes.exe File opened for modification C:\Windows\SysWOW64\ahiu.exe kdzz.exe File created C:\Windows\SysWOW64\pykz.exe capx.exe File created C:\Windows\SysWOW64\yahs.exe obvv.exe File opened for modification C:\Windows\SysWOW64\viof.exe izic.exe File created C:\Windows\SysWOW64\flwd.exe pkzv.exe File opened for modification C:\Windows\SysWOW64\doep.exe Process not Found File opened for modification C:\Windows\SysWOW64\sywd.exe Process not Found File opened for modification C:\Windows\SysWOW64\agvy.exe Process not Found File opened for modification C:\Windows\SysWOW64\yxxu.exe lkff.exe File created C:\Windows\SysWOW64\qmmh.exe alpz.exe File opened for modification C:\Windows\SysWOW64\nunq.exe Process not Found File opened for modification C:\Windows\SysWOW64\pjui.exe Process not Found File opened for modification C:\Windows\SysWOW64\pkeb.exe ctbg.exe File created C:\Windows\SysWOW64\butp.exe okvm.exe File created C:\Windows\SysWOW64\awce.exe njth.exe File opened for modification C:\Windows\SysWOW64\mskg.exe zied.exe File opened for modification C:\Windows\SysWOW64\whsy.exe juab.exe File opened for modification C:\Windows\SysWOW64\ofip.exe eyws.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 5020 set thread context of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 3028 set thread context of 3460 3028 vlqm.exe 86 PID 3040 set thread context of 3232 3040 brvu.exe 90 PID 512 set thread context of 3328 512 ltke.exe 93 PID 3832 set thread context of 2020 3832 dtls.exe 95 PID 4004 set thread context of 556 4004 naxp.exe 97 PID 2204 set thread context of 3756 2204 anhf.exe 99 PID 3504 set thread context of 2552 3504 nayv.exe 101 PID 2684 set thread context of 624 2684 yzcs.exe 103 PID 212 set thread context of 716 212 lmui.exe 105 PID 2128 set thread context of 1976 2128 ylpk.exe 107 PID 4284 set thread context of 2944 4284 ikbq.exe 109 PID 3692 set thread context of 3700 3692 yobd.exe 111 PID 4528 set thread context of 2532 4528 gpad.exe 115 PID 1832 set thread context of 4224 1832 vxml.exe 117 PID 3460 set thread context of 1860 3460 feyi.exe 119 PID 4556 set thread context of 1792 4556 vjyd.exe 121 PID 864 set thread context of 4328 864 ftno.exe 123 PID 1720 set thread context of 4720 1720 tvuy.exe 126 PID 4536 set thread context of 4092 4536 dfrb.exe 129 PID 2892 set thread context of 872 2892 nbkt.exe 131 PID 2472 set thread context of 3564 2472 aobj.exe 133 PID 3284 set thread context of 5092 3284 nblz.exe 135 PID 3444 set thread context of 1320 3444 azob.exe 137 PID 4808 set thread context of 4800 4808 nqje.exe 139 PID 1212 set thread context of 4924 1212 adau.exe 141 PID 1812 set thread context of 1204 1812 kker.exe 143 PID 2320 set thread context of 4764 2320 yxwp.exe 145 PID 3264 set thread context of 2072 3264 lkff.exe 147 PID 2688 set thread context of 3556 2688 yxxu.exe 149 PID 4024 set thread context of 1720 4024 ihmf.exe 151 PID 1620 set thread context of 408 1620 vueu.exe 153 PID 1564 set thread context of 4104 1564 ihnk.exe 156 PID 3140 set thread context of 2472 3140 shzi.exe 158 PID 4260 set thread context of 4416 4260 fxuk.exe 160 PID 4020 set thread context of 3444 4020 thbv.exe 162 PID 2944 set thread context of 2756 2944 gfvy.exe 164 PID 2732 set thread context of 5036 2732 tsnn.exe 166 PID 1548 set thread context of 224 1548 dvcy.exe 168 PID 1488 set thread context of 4368 1488 qqun.exe 170 PID 4032 set thread context of 3796 4032 apyl.exe 172 PID 4088 set thread context of 4852 4088 qqvt.exe 174 PID 4764 set thread context of 4524 4764 askd.exe 176 PID 1344 set thread context of 1816 1344 nnct.exe 178 PID 404 set thread context of 1096 404 aexw.exe 180 PID 3308 set thread context of 2288 3308 nndg.exe 183 PID 3836 set thread context of 1700 3836 xqsr.exe 186 PID 2472 set thread context of 1660 2472 klkg.exe 188 PID 4416 set thread context of 4472 4416 yytw.exe 190 PID 3700 set thread context of 440 3700 ixgu.exe 192 PID 3280 set thread context of 3120 3280 nkpj.exe 194 PID 1736 set thread context of 2216 1736 aism.exe 196 PID 1004 set thread context of 1868 1004 nznp.exe 198 PID 2156 set thread context of 2972 2156 amee.exe 200 PID 448 set thread context of 2688 448 nzou.exe 202 PID 3000 set thread context of 3996 3000 xgaz.exe 204 PID 2008 set thread context of 1636 2008 hfex.exe 206 PID 2080 set thread context of 1012 2080 vswn.exe 208 PID 4484 set thread context of 4260 4484 hjqp.exe 210 PID 1208 set thread context of 4076 1208 vsxs.exe 212 PID 1580 set thread context of 5020 1580 iudi.exe 214 PID 4792 set thread context of 1320 4792 sqes.exe 216 PID 1820 set thread context of 3280 1820 iuen.exe 218 PID 2460 set thread context of 1000 2460 sfty.exe 220 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qmmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language enok.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvuy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eote.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wfgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zuab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bwds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dart.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zqhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pofk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ueux.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eyws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eoob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ckxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language capx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nzou.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uxfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language twus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gpad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xqsr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mxco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sags.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ottp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hcyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tadl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ambf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hgkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pkxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qqvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qsxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zkfi.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key qqvt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key cmiw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" tnyh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" eoob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" zkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ wfgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ dglq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key zrly.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" aifb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ovwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" yahs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ zrly.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key ltke.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key aexw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" zrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" lifa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" qdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ wnpz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" rhbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key sopx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mifn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key dtls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" otbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ybfn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key shzy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ adau.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" thbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" wdyv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key bmck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key umbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ aobj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key fyca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key hzhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ ssnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key fthp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" hpgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ pkzv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" zqnj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ zkfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" mqkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" ozku.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key spbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key fnrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key nndg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" fshn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ njth.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ yiyf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 5020 wrote to memory of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 5020 wrote to memory of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 5020 wrote to memory of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 5020 wrote to memory of 4200 5020 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 84 PID 4200 wrote to memory of 3028 4200 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 85 PID 4200 wrote to memory of 3028 4200 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 85 PID 4200 wrote to memory of 3028 4200 c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe 85 PID 3028 wrote to memory of 3460 3028 vlqm.exe 86 PID 3028 wrote to memory of 3460 3028 vlqm.exe 86 PID 3028 wrote to memory of 3460 3028 vlqm.exe 86 PID 3028 wrote to memory of 3460 3028 vlqm.exe 86 PID 3028 wrote to memory of 3460 3028 vlqm.exe 86 PID 3460 wrote to memory of 3040 3460 vlqm.exe 87 PID 3460 wrote to memory of 3040 3460 vlqm.exe 87 PID 3460 wrote to memory of 3040 3460 vlqm.exe 87 PID 3040 wrote to memory of 3232 3040 brvu.exe 90 PID 3040 wrote to memory of 3232 3040 brvu.exe 90 PID 3040 wrote to memory of 3232 3040 brvu.exe 90 PID 3040 wrote to memory of 3232 3040 brvu.exe 90 PID 3040 wrote to memory of 3232 3040 brvu.exe 90 PID 3232 wrote to memory of 512 3232 brvu.exe 92 PID 3232 wrote to memory of 512 3232 brvu.exe 92 PID 3232 wrote to memory of 512 3232 brvu.exe 92 PID 512 wrote to memory of 3328 512 ltke.exe 93 PID 512 wrote to memory of 3328 512 ltke.exe 93 PID 512 wrote to memory of 3328 512 ltke.exe 93 PID 512 wrote to memory of 3328 512 ltke.exe 93 PID 512 wrote to memory of 3328 512 ltke.exe 93 PID 3328 wrote to memory of 3832 3328 ltke.exe 94 PID 3328 wrote to memory of 3832 3328 ltke.exe 94 PID 3328 wrote to memory of 3832 3328 ltke.exe 94 PID 3832 wrote to memory of 2020 3832 dtls.exe 95 PID 3832 wrote to memory of 2020 3832 dtls.exe 95 PID 3832 wrote to memory of 2020 3832 dtls.exe 95 PID 3832 wrote to memory of 2020 3832 dtls.exe 95 PID 3832 wrote to memory of 2020 3832 dtls.exe 95 PID 2020 wrote to memory of 4004 2020 dtls.exe 96 PID 2020 wrote to memory of 4004 2020 dtls.exe 96 PID 2020 wrote to memory of 4004 2020 dtls.exe 96 PID 4004 wrote to memory of 556 4004 naxp.exe 97 PID 4004 wrote to memory of 556 4004 naxp.exe 97 PID 4004 wrote to memory of 556 4004 naxp.exe 97 PID 4004 wrote to memory of 556 4004 naxp.exe 97 PID 4004 wrote to memory of 556 4004 naxp.exe 97 PID 556 wrote to memory of 2204 556 naxp.exe 98 PID 556 wrote to memory of 2204 556 naxp.exe 98 PID 556 wrote to memory of 2204 556 naxp.exe 98 PID 2204 wrote to memory of 3756 2204 anhf.exe 99 PID 2204 wrote to memory of 3756 2204 anhf.exe 99 PID 2204 wrote to memory of 3756 2204 anhf.exe 99 PID 2204 wrote to memory of 3756 2204 anhf.exe 99 PID 2204 wrote to memory of 3756 2204 anhf.exe 99 PID 3756 wrote to memory of 3504 3756 anhf.exe 100 PID 3756 wrote to memory of 3504 3756 anhf.exe 100 PID 3756 wrote to memory of 3504 3756 anhf.exe 100 PID 3504 wrote to memory of 2552 3504 nayv.exe 101 PID 3504 wrote to memory of 2552 3504 nayv.exe 101 PID 3504 wrote to memory of 2552 3504 nayv.exe 101 PID 3504 wrote to memory of 2552 3504 nayv.exe 101 PID 3504 wrote to memory of 2552 3504 nayv.exe 101 PID 2552 wrote to memory of 2684 2552 nayv.exe 102 PID 2552 wrote to memory of 2684 2552 nayv.exe 102 PID 2552 wrote to memory of 2684 2552 nayv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\vlqm.exeC:\Windows\system32\vlqm.exe 1172 "C:\Users\Admin\AppData\Local\Temp\c85b429975be01e19fbac6a0a44fbafd_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\vlqm.exeC:\Windows\SysWOW64\vlqm.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\brvu.exeC:\Windows\system32\brvu.exe 1152 "C:\Windows\SysWOW64\vlqm.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\brvu.exeC:\Windows\SysWOW64\brvu.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\ltke.exeC:\Windows\system32\ltke.exe 1152 "C:\Windows\SysWOW64\brvu.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\ltke.exeC:\Windows\SysWOW64\ltke.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\dtls.exeC:\Windows\system32\dtls.exe 1160 "C:\Windows\SysWOW64\ltke.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\dtls.exeC:\Windows\SysWOW64\dtls.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\naxp.exeC:\Windows\system32\naxp.exe 1152 "C:\Windows\SysWOW64\dtls.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\naxp.exeC:\Windows\SysWOW64\naxp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\anhf.exeC:\Windows\system32\anhf.exe 1152 "C:\Windows\SysWOW64\naxp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\anhf.exeC:\Windows\SysWOW64\anhf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\nayv.exeC:\Windows\system32\nayv.exe 1152 "C:\Windows\SysWOW64\anhf.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\nayv.exeC:\Windows\SysWOW64\nayv.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\yzcs.exeC:\Windows\system32\yzcs.exe 1156 "C:\Windows\SysWOW64\nayv.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2684 -
C:\Windows\SysWOW64\yzcs.exeC:\Windows\SysWOW64\yzcs.exe18⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\lmui.exeC:\Windows\system32\lmui.exe 1152 "C:\Windows\SysWOW64\yzcs.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:212 -
C:\Windows\SysWOW64\lmui.exeC:\Windows\SysWOW64\lmui.exe20⤵
- Executes dropped EXE
PID:716 -
C:\Windows\SysWOW64\ylpk.exeC:\Windows\system32\ylpk.exe 1152 "C:\Windows\SysWOW64\lmui.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2128 -
C:\Windows\SysWOW64\ylpk.exeC:\Windows\SysWOW64\ylpk.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1976 -
C:\Windows\SysWOW64\ikbq.exeC:\Windows\system32\ikbq.exe 1156 "C:\Windows\SysWOW64\ylpk.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4284 -
C:\Windows\SysWOW64\ikbq.exeC:\Windows\SysWOW64\ikbq.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\yobd.exeC:\Windows\system32\yobd.exe 1152 "C:\Windows\SysWOW64\ikbq.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3692 -
C:\Windows\SysWOW64\yobd.exeC:\Windows\SysWOW64\yobd.exe26⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\gpad.exeC:\Windows\system32\gpad.exe 1152 "C:\Windows\SysWOW64\yobd.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4528 -
C:\Windows\SysWOW64\gpad.exeC:\Windows\SysWOW64\gpad.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\SysWOW64\vxml.exeC:\Windows\system32\vxml.exe 1152 "C:\Windows\SysWOW64\gpad.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1832 -
C:\Windows\SysWOW64\vxml.exeC:\Windows\SysWOW64\vxml.exe30⤵
- Executes dropped EXE
PID:4224 -
C:\Windows\SysWOW64\feyi.exeC:\Windows\system32\feyi.exe 1144 "C:\Windows\SysWOW64\vxml.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3460 -
C:\Windows\SysWOW64\feyi.exeC:\Windows\SysWOW64\feyi.exe32⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\vjyd.exeC:\Windows\system32\vjyd.exe 1036 "C:\Windows\SysWOW64\feyi.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4556 -
C:\Windows\SysWOW64\vjyd.exeC:\Windows\SysWOW64\vjyd.exe34⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\SysWOW64\ftno.exeC:\Windows\system32\ftno.exe 1152 "C:\Windows\SysWOW64\vjyd.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:864 -
C:\Windows\SysWOW64\ftno.exeC:\Windows\SysWOW64\ftno.exe36⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\tvuy.exeC:\Windows\system32\tvuy.exe 1152 "C:\Windows\SysWOW64\ftno.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Windows\SysWOW64\tvuy.exeC:\Windows\SysWOW64\tvuy.exe38⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\dfrb.exeC:\Windows\system32\dfrb.exe 1152 "C:\Windows\SysWOW64\tvuy.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4536 -
C:\Windows\SysWOW64\dfrb.exeC:\Windows\SysWOW64\dfrb.exe40⤵
- Executes dropped EXE
PID:4092 -
C:\Windows\SysWOW64\nbkt.exeC:\Windows\system32\nbkt.exe 1152 "C:\Windows\SysWOW64\dfrb.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2892 -
C:\Windows\SysWOW64\nbkt.exeC:\Windows\SysWOW64\nbkt.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:872 -
C:\Windows\SysWOW64\aobj.exeC:\Windows\system32\aobj.exe 1152 "C:\Windows\SysWOW64\nbkt.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
PID:2472 -
C:\Windows\SysWOW64\aobj.exeC:\Windows\SysWOW64\aobj.exe44⤵
- Executes dropped EXE
PID:3564 -
C:\Windows\SysWOW64\nblz.exeC:\Windows\system32\nblz.exe 1156 "C:\Windows\SysWOW64\aobj.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3284 -
C:\Windows\SysWOW64\nblz.exeC:\Windows\SysWOW64\nblz.exe46⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\SysWOW64\azob.exeC:\Windows\system32\azob.exe 1168 "C:\Windows\SysWOW64\nblz.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3444 -
C:\Windows\SysWOW64\azob.exeC:\Windows\SysWOW64\azob.exe48⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\nqje.exeC:\Windows\system32\nqje.exe 1152 "C:\Windows\SysWOW64\azob.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4808 -
C:\Windows\SysWOW64\nqje.exeC:\Windows\SysWOW64\nqje.exe50⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\adau.exeC:\Windows\system32\adau.exe 1156 "C:\Windows\SysWOW64\nqje.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1212 -
C:\Windows\SysWOW64\adau.exeC:\Windows\SysWOW64\adau.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\kker.exeC:\Windows\system32\kker.exe 1128 "C:\Windows\SysWOW64\adau.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1812 -
C:\Windows\SysWOW64\kker.exeC:\Windows\SysWOW64\kker.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Windows\SysWOW64\yxwp.exeC:\Windows\system32\yxwp.exe 1156 "C:\Windows\SysWOW64\kker.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2320 -
C:\Windows\SysWOW64\yxwp.exeC:\Windows\SysWOW64\yxwp.exe56⤵
- Executes dropped EXE
PID:4764 -
C:\Windows\SysWOW64\lkff.exeC:\Windows\system32\lkff.exe 1152 "C:\Windows\SysWOW64\yxwp.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3264 -
C:\Windows\SysWOW64\lkff.exeC:\Windows\SysWOW64\lkff.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\yxxu.exeC:\Windows\system32\yxxu.exe 1156 "C:\Windows\SysWOW64\lkff.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2688 -
C:\Windows\SysWOW64\yxxu.exeC:\Windows\SysWOW64\yxxu.exe60⤵
- Executes dropped EXE
PID:3556 -
C:\Windows\SysWOW64\ihmf.exeC:\Windows\system32\ihmf.exe 1156 "C:\Windows\SysWOW64\yxxu.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4024 -
C:\Windows\SysWOW64\ihmf.exeC:\Windows\SysWOW64\ihmf.exe62⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\vueu.exeC:\Windows\system32\vueu.exe 1148 "C:\Windows\SysWOW64\ihmf.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1620 -
C:\Windows\SysWOW64\vueu.exeC:\Windows\SysWOW64\vueu.exe64⤵
- Executes dropped EXE
PID:408 -
C:\Windows\SysWOW64\ihnk.exeC:\Windows\system32\ihnk.exe 1152 "C:\Windows\SysWOW64\vueu.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1564 -
C:\Windows\SysWOW64\ihnk.exeC:\Windows\SysWOW64\ihnk.exe66⤵
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\shzi.exeC:\Windows\system32\shzi.exe 1164 "C:\Windows\SysWOW64\ihnk.exe"67⤵
- Suspicious use of SetThreadContext
PID:3140 -
C:\Windows\SysWOW64\shzi.exeC:\Windows\SysWOW64\shzi.exe68⤵PID:2472
-
C:\Windows\SysWOW64\fxuk.exeC:\Windows\system32\fxuk.exe 1152 "C:\Windows\SysWOW64\shzi.exe"69⤵
- Suspicious use of SetThreadContext
PID:4260 -
C:\Windows\SysWOW64\fxuk.exeC:\Windows\SysWOW64\fxuk.exe70⤵PID:4416
-
C:\Windows\SysWOW64\thbv.exeC:\Windows\system32\thbv.exe 1152 "C:\Windows\SysWOW64\fxuk.exe"71⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:4020 -
C:\Windows\SysWOW64\thbv.exeC:\Windows\SysWOW64\thbv.exe72⤵PID:3444
-
C:\Windows\SysWOW64\gfvy.exeC:\Windows\system32\gfvy.exe 1152 "C:\Windows\SysWOW64\thbv.exe"73⤵
- Suspicious use of SetThreadContext
PID:2944 -
C:\Windows\SysWOW64\gfvy.exeC:\Windows\SysWOW64\gfvy.exe74⤵PID:2756
-
C:\Windows\SysWOW64\tsnn.exeC:\Windows\system32\tsnn.exe 1156 "C:\Windows\SysWOW64\gfvy.exe"75⤵
- Suspicious use of SetThreadContext
PID:2732 -
C:\Windows\SysWOW64\tsnn.exeC:\Windows\SysWOW64\tsnn.exe76⤵
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\dvcy.exeC:\Windows\system32\dvcy.exe 1148 "C:\Windows\SysWOW64\tsnn.exe"77⤵
- Suspicious use of SetThreadContext
PID:1548 -
C:\Windows\SysWOW64\dvcy.exeC:\Windows\SysWOW64\dvcy.exe78⤵
- System Location Discovery: System Language Discovery
PID:224 -
C:\Windows\SysWOW64\qqun.exeC:\Windows\system32\qqun.exe 1152 "C:\Windows\SysWOW64\dvcy.exe"79⤵
- Suspicious use of SetThreadContext
PID:1488 -
C:\Windows\SysWOW64\qqun.exeC:\Windows\SysWOW64\qqun.exe80⤵PID:4368
-
C:\Windows\SysWOW64\apyl.exeC:\Windows\system32\apyl.exe 1152 "C:\Windows\SysWOW64\qqun.exe"81⤵
- Suspicious use of SetThreadContext
PID:4032 -
C:\Windows\SysWOW64\apyl.exeC:\Windows\SysWOW64\apyl.exe82⤵PID:3796
-
C:\Windows\SysWOW64\qqvt.exeC:\Windows\system32\qqvt.exe 1156 "C:\Windows\SysWOW64\apyl.exe"83⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:4088 -
C:\Windows\SysWOW64\qqvt.exeC:\Windows\SysWOW64\qqvt.exe84⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\askd.exeC:\Windows\system32\askd.exe 1152 "C:\Windows\SysWOW64\qqvt.exe"85⤵
- Suspicious use of SetThreadContext
PID:4764 -
C:\Windows\SysWOW64\askd.exeC:\Windows\SysWOW64\askd.exe86⤵PID:4524
-
C:\Windows\SysWOW64\nnct.exeC:\Windows\system32\nnct.exe 1156 "C:\Windows\SysWOW64\askd.exe"87⤵
- Suspicious use of SetThreadContext
PID:1344 -
C:\Windows\SysWOW64\nnct.exeC:\Windows\SysWOW64\nnct.exe88⤵PID:1816
-
C:\Windows\SysWOW64\aexw.exeC:\Windows\system32\aexw.exe 1152 "C:\Windows\SysWOW64\nnct.exe"89⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:404 -
C:\Windows\SysWOW64\aexw.exeC:\Windows\SysWOW64\aexw.exe90⤵PID:1096
-
C:\Windows\SysWOW64\nndg.exeC:\Windows\system32\nndg.exe 1156 "C:\Windows\SysWOW64\aexw.exe"91⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:3308 -
C:\Windows\SysWOW64\nndg.exeC:\Windows\SysWOW64\nndg.exe92⤵PID:2288
-
C:\Windows\SysWOW64\xqsr.exeC:\Windows\system32\xqsr.exe 1152 "C:\Windows\SysWOW64\nndg.exe"93⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Windows\SysWOW64\xqsr.exeC:\Windows\SysWOW64\xqsr.exe94⤵
- Drops file in System32 directory
PID:1700 -
C:\Windows\SysWOW64\klkg.exeC:\Windows\system32\klkg.exe 1016 "C:\Windows\SysWOW64\xqsr.exe"95⤵
- Suspicious use of SetThreadContext
PID:2472 -
C:\Windows\SysWOW64\klkg.exeC:\Windows\SysWOW64\klkg.exe96⤵PID:1660
-
C:\Windows\SysWOW64\yytw.exeC:\Windows\system32\yytw.exe 1152 "C:\Windows\SysWOW64\klkg.exe"97⤵
- Suspicious use of SetThreadContext
PID:4416 -
C:\Windows\SysWOW64\yytw.exeC:\Windows\SysWOW64\yytw.exe98⤵PID:4472
-
C:\Windows\SysWOW64\ixgu.exeC:\Windows\system32\ixgu.exe 1148 "C:\Windows\SysWOW64\yytw.exe"99⤵
- Suspicious use of SetThreadContext
PID:3700 -
C:\Windows\SysWOW64\ixgu.exeC:\Windows\SysWOW64\ixgu.exe100⤵PID:440
-
C:\Windows\SysWOW64\nkpj.exeC:\Windows\system32\nkpj.exe 1168 "C:\Windows\SysWOW64\ixgu.exe"101⤵
- Suspicious use of SetThreadContext
PID:3280 -
C:\Windows\SysWOW64\nkpj.exeC:\Windows\SysWOW64\nkpj.exe102⤵PID:3120
-
C:\Windows\SysWOW64\aism.exeC:\Windows\system32\aism.exe 1152 "C:\Windows\SysWOW64\nkpj.exe"103⤵
- Suspicious use of SetThreadContext
PID:1736 -
C:\Windows\SysWOW64\aism.exeC:\Windows\SysWOW64\aism.exe104⤵PID:2216
-
C:\Windows\SysWOW64\nznp.exeC:\Windows\system32\nznp.exe 1152 "C:\Windows\SysWOW64\aism.exe"105⤵
- Suspicious use of SetThreadContext
PID:1004 -
C:\Windows\SysWOW64\nznp.exeC:\Windows\SysWOW64\nznp.exe106⤵PID:1868
-
C:\Windows\SysWOW64\amee.exeC:\Windows\system32\amee.exe 1152 "C:\Windows\SysWOW64\nznp.exe"107⤵
- Suspicious use of SetThreadContext
PID:2156 -
C:\Windows\SysWOW64\amee.exeC:\Windows\SysWOW64\amee.exe108⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\nzou.exeC:\Windows\system32\nzou.exe 1156 "C:\Windows\SysWOW64\amee.exe"109⤵
- Suspicious use of SetThreadContext
PID:448 -
C:\Windows\SysWOW64\nzou.exeC:\Windows\SysWOW64\nzou.exe110⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\xgaz.exeC:\Windows\system32\xgaz.exe 1152 "C:\Windows\SysWOW64\nzou.exe"111⤵
- Suspicious use of SetThreadContext
PID:3000 -
C:\Windows\SysWOW64\xgaz.exeC:\Windows\SysWOW64\xgaz.exe112⤵PID:3996
-
C:\Windows\SysWOW64\hfex.exeC:\Windows\system32\hfex.exe 1148 "C:\Windows\SysWOW64\xgaz.exe"113⤵
- Suspicious use of SetThreadContext
PID:2008 -
C:\Windows\SysWOW64\hfex.exeC:\Windows\SysWOW64\hfex.exe114⤵PID:1636
-
C:\Windows\SysWOW64\vswn.exeC:\Windows\system32\vswn.exe 1152 "C:\Windows\SysWOW64\hfex.exe"115⤵
- Suspicious use of SetThreadContext
PID:2080 -
C:\Windows\SysWOW64\vswn.exeC:\Windows\SysWOW64\vswn.exe116⤵PID:1012
-
C:\Windows\SysWOW64\hjqp.exeC:\Windows\system32\hjqp.exe 1152 "C:\Windows\SysWOW64\vswn.exe"117⤵
- Suspicious use of SetThreadContext
PID:4484 -
C:\Windows\SysWOW64\hjqp.exeC:\Windows\SysWOW64\hjqp.exe118⤵PID:4260
-
C:\Windows\SysWOW64\vsxs.exeC:\Windows\system32\vsxs.exe 1152 "C:\Windows\SysWOW64\hjqp.exe"119⤵
- Suspicious use of SetThreadContext
PID:1208 -
C:\Windows\SysWOW64\vsxs.exeC:\Windows\SysWOW64\vsxs.exe120⤵PID:4076
-
C:\Windows\SysWOW64\iudi.exeC:\Windows\system32\iudi.exe 1152 "C:\Windows\SysWOW64\vsxs.exe"121⤵
- Suspicious use of SetThreadContext
PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-