Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d32259306086f5dd8682be41476b204f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
d32259306086f5dd8682be41476b204f_JaffaCakes118.exe
-
Size
200KB
-
MD5
d32259306086f5dd8682be41476b204f
-
SHA1
378611488a197a49a81d0399d0b4c8d93e2f95bb
-
SHA256
3842473498ce97711d865f558ae8b6a9de381dbec6fd265f5f20ef14a7da200a
-
SHA512
49ecab8e23051c85b1206525022b5e5d5fd2ff8fec2ee954d7e5a5cca7b08c269ce9710a1faa1ab995ce897383ddead98d868aa083f734c612776d00869c5a15
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqyvU2r1vsKM4ltyjw:PhOm2sI93UufdC67cihvH1S/k
Malware Config
Signatures
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/1224-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-44-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2668-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-81-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2560-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-119-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/792-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/468-151-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1980-159-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1980-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-186-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2280-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-222-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1588-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-258-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2536-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-326-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2556-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-407-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/608-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-510-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-528-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/888-538-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-599-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-680-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/608-685-0x00000000002E0000-0x0000000000309000-memory.dmp family_blackmoon behavioral1/memory/2000-698-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1564-744-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1592-751-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/892-795-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2468-846-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2904-873-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1196-1011-0x00000000001E0000-0x0000000000209000-memory.dmp family_blackmoon behavioral1/memory/3068-1161-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1060-1230-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/536-1249-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1580-1324-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1868 xrllrxf.exe 2536 fxlrxlx.exe 2740 tnhnbh.exe 2668 9jddd.exe 2848 llfrllx.exe 2568 hbntbt.exe 2828 dvdpv.exe 1716 lffxrlx.exe 2560 5bttbn.exe 2680 7hhttb.exe 2152 dvjpv.exe 2628 xrlrffr.exe 792 tnhtbh.exe 608 1pppd.exe 2756 rrfrxxl.exe 468 5htbhh.exe 1980 dvjpv.exe 536 vpjjj.exe 3012 rlxrflx.exe 2280 tnbnnn.exe 2208 pppjd.exe 1592 xxffxxl.exe 704 tnhhtt.exe 1588 btbtth.exe 1748 5vppv.exe 1508 1xfxfrx.exe 1444 hbnthb.exe 2232 1ppdj.exe 1456 fxllxxl.exe 280 nhbntb.exe 768 vpddv.exe 2488 vpjjp.exe 2536 llxflxl.exe 2512 9nnnbh.exe 2940 pjppv.exe 2108 dvpdd.exe 2816 xrrllff.exe 2868 ttnnbb.exe 2848 9nhnnt.exe 2012 pjvpv.exe 2760 vvpvj.exe 2724 9lxxxxf.exe 2556 hhbtth.exe 2580 bnbbth.exe 2624 jppdp.exe 1800 fxxllrr.exe 1644 xxrfxxl.exe 2908 7htbhh.exe 1756 1dvvp.exe 548 3lxxrxr.exe 608 5lxxfrx.exe 2804 rlfflrx.exe 840 nhtnht.exe 380 dpvpd.exe 844 xrxxffr.exe 3028 fxllflr.exe 3012 nhtbnn.exe 2396 thnbhb.exe 2456 pjpvj.exe 1448 jvjjp.exe 444 xrrrrrf.exe 704 xxlrffr.exe 1680 nhbtbb.exe 1688 hbnbnb.exe -
resource yara_rule behavioral1/memory/1224-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/608-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-258-0x0000000000430000-0x0000000000459000-memory.dmp upx behavioral1/memory/280-275-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2536-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-407-0x00000000002C0000-0x00000000002E9000-memory.dmp upx behavioral1/memory/608-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-491-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-517-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-599-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-614-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2860-613-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-660-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-680-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-873-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/3068-884-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-909-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-959-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1196-1011-0x00000000001E0000-0x0000000000209000-memory.dmp upx behavioral1/memory/348-1040-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/584-1066-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-1133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-1223-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1868 1224 d32259306086f5dd8682be41476b204f_JaffaCakes118.exe 31 PID 1224 wrote to memory of 1868 1224 d32259306086f5dd8682be41476b204f_JaffaCakes118.exe 31 PID 1224 wrote to memory of 1868 1224 d32259306086f5dd8682be41476b204f_JaffaCakes118.exe 31 PID 1224 wrote to memory of 1868 1224 d32259306086f5dd8682be41476b204f_JaffaCakes118.exe 31 PID 1868 wrote to memory of 2536 1868 xrllrxf.exe 32 PID 1868 wrote to memory of 2536 1868 xrllrxf.exe 32 PID 1868 wrote to memory of 2536 1868 xrllrxf.exe 32 PID 1868 wrote to memory of 2536 1868 xrllrxf.exe 32 PID 2536 wrote to memory of 2740 2536 fxlrxlx.exe 33 PID 2536 wrote to memory of 2740 2536 fxlrxlx.exe 33 PID 2536 wrote to memory of 2740 2536 fxlrxlx.exe 33 PID 2536 wrote to memory of 2740 2536 fxlrxlx.exe 33 PID 2740 wrote to memory of 2668 2740 tnhnbh.exe 34 PID 2740 wrote to memory of 2668 2740 tnhnbh.exe 34 PID 2740 wrote to memory of 2668 2740 tnhnbh.exe 34 PID 2740 wrote to memory of 2668 2740 tnhnbh.exe 34 PID 2668 wrote to memory of 2848 2668 9jddd.exe 35 PID 2668 wrote to memory of 2848 2668 9jddd.exe 35 PID 2668 wrote to memory of 2848 2668 9jddd.exe 35 PID 2668 wrote to memory of 2848 2668 9jddd.exe 35 PID 2848 wrote to memory of 2568 2848 llfrllx.exe 36 PID 2848 wrote to memory of 2568 2848 llfrllx.exe 36 PID 2848 wrote to memory of 2568 2848 llfrllx.exe 36 PID 2848 wrote to memory of 2568 2848 llfrllx.exe 36 PID 2568 wrote to memory of 2828 2568 hbntbt.exe 37 PID 2568 wrote to memory of 2828 2568 hbntbt.exe 37 PID 2568 wrote to memory of 2828 2568 hbntbt.exe 37 PID 2568 wrote to memory of 2828 2568 hbntbt.exe 37 PID 2828 wrote to memory of 1716 2828 dvdpv.exe 38 PID 2828 wrote to memory of 1716 2828 dvdpv.exe 38 PID 2828 wrote to memory of 1716 2828 dvdpv.exe 38 PID 2828 wrote to memory of 1716 2828 dvdpv.exe 38 PID 1716 wrote to memory of 2560 1716 lffxrlx.exe 39 PID 1716 wrote to memory of 2560 1716 lffxrlx.exe 39 PID 1716 wrote to memory of 2560 1716 lffxrlx.exe 39 PID 1716 wrote to memory of 2560 1716 lffxrlx.exe 39 PID 2560 wrote to memory of 2680 2560 5bttbn.exe 40 PID 2560 wrote to memory of 2680 2560 5bttbn.exe 40 PID 2560 wrote to memory of 2680 2560 5bttbn.exe 40 PID 2560 wrote to memory of 2680 2560 5bttbn.exe 40 PID 2680 wrote to memory of 2152 2680 7hhttb.exe 41 PID 2680 wrote to memory of 2152 2680 7hhttb.exe 41 PID 2680 wrote to memory of 2152 2680 7hhttb.exe 41 PID 2680 wrote to memory of 2152 2680 7hhttb.exe 41 PID 2152 wrote to memory of 2628 2152 dvjpv.exe 42 PID 2152 wrote to memory of 2628 2152 dvjpv.exe 42 PID 2152 wrote to memory of 2628 2152 dvjpv.exe 42 PID 2152 wrote to memory of 2628 2152 dvjpv.exe 42 PID 2628 wrote to memory of 792 2628 xrlrffr.exe 43 PID 2628 wrote to memory of 792 2628 xrlrffr.exe 43 PID 2628 wrote to memory of 792 2628 xrlrffr.exe 43 PID 2628 wrote to memory of 792 2628 xrlrffr.exe 43 PID 792 wrote to memory of 608 792 tnhtbh.exe 44 PID 792 wrote to memory of 608 792 tnhtbh.exe 44 PID 792 wrote to memory of 608 792 tnhtbh.exe 44 PID 792 wrote to memory of 608 792 tnhtbh.exe 44 PID 608 wrote to memory of 2756 608 1pppd.exe 45 PID 608 wrote to memory of 2756 608 1pppd.exe 45 PID 608 wrote to memory of 2756 608 1pppd.exe 45 PID 608 wrote to memory of 2756 608 1pppd.exe 45 PID 2756 wrote to memory of 468 2756 rrfrxxl.exe 46 PID 2756 wrote to memory of 468 2756 rrfrxxl.exe 46 PID 2756 wrote to memory of 468 2756 rrfrxxl.exe 46 PID 2756 wrote to memory of 468 2756 rrfrxxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32259306086f5dd8682be41476b204f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d32259306086f5dd8682be41476b204f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\xrllrxf.exec:\xrllrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tnhnbh.exec:\tnhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\9jddd.exec:\9jddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\llfrllx.exec:\llfrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hbntbt.exec:\hbntbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\dvdpv.exec:\dvdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lffxrlx.exec:\lffxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\5bttbn.exec:\5bttbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\7hhttb.exec:\7hhttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\dvjpv.exec:\dvjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xrlrffr.exec:\xrlrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tnhtbh.exec:\tnhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\1pppd.exec:\1pppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\5htbhh.exec:\5htbhh.exe17⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvjpv.exec:\dvjpv.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vpjjj.exec:\vpjjj.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlxrflx.exec:\rlxrflx.exe20⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnbnnn.exec:\tnbnnn.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pppjd.exec:\pppjd.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xxffxxl.exec:\xxffxxl.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnhhtt.exec:\tnhhtt.exe24⤵
- Executes dropped EXE
PID:704 -
\??\c:\btbtth.exec:\btbtth.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5vppv.exec:\5vppv.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1xfxfrx.exec:\1xfxfrx.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbnthb.exec:\hbnthb.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1ppdj.exec:\1ppdj.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fxllxxl.exec:\fxllxxl.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nhbntb.exec:\nhbntb.exe31⤵
- Executes dropped EXE
PID:280 -
\??\c:\vpddv.exec:\vpddv.exe32⤵
- Executes dropped EXE
PID:768 -
\??\c:\vpjjp.exec:\vpjjp.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\llxflxl.exec:\llxflxl.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9nnnbh.exec:\9nnnbh.exe35⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjppv.exec:\pjppv.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvpdd.exec:\dvpdd.exe37⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrrllff.exec:\xrrllff.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ttnnbb.exec:\ttnnbb.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9nhnnt.exec:\9nhnnt.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjvpv.exec:\pjvpv.exe41⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vvpvj.exec:\vvpvj.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9lxxxxf.exec:\9lxxxxf.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhbtth.exec:\hhbtth.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bnbbth.exec:\bnbbth.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jppdp.exec:\jppdp.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxxllrr.exec:\fxxllrr.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\7htbhh.exec:\7htbhh.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1dvvp.exec:\1dvvp.exe50⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3lxxrxr.exec:\3lxxrxr.exe51⤵
- Executes dropped EXE
PID:548 -
\??\c:\5lxxfrx.exec:\5lxxfrx.exe52⤵
- Executes dropped EXE
PID:608 -
\??\c:\rlfflrx.exec:\rlfflrx.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nhtnht.exec:\nhtnht.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\dpvpd.exec:\dpvpd.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\xrxxffr.exec:\xrxxffr.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\fxllflr.exec:\fxllflr.exe57⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhtbnn.exec:\nhtbnn.exe58⤵
- Executes dropped EXE
PID:3012 -
\??\c:\thnbhb.exec:\thnbhb.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pjpvj.exec:\pjpvj.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvjjp.exec:\jvjjp.exe61⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xrrrrrf.exec:\xrrrrrf.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\xxlrffr.exec:\xxlrffr.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\nhbtbb.exec:\nhbtbb.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hbnbnb.exec:\hbnbnb.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dvjjd.exec:\dvjjd.exe66⤵PID:2524
-
\??\c:\5lfflxf.exec:\5lfflxf.exe67⤵PID:1440
-
\??\c:\rlxrflx.exec:\rlxrflx.exe68⤵PID:2116
-
\??\c:\xxrrflx.exec:\xxrrflx.exe69⤵PID:2968
-
\??\c:\1nhhtt.exec:\1nhhtt.exe70⤵PID:2440
-
\??\c:\jdjjj.exec:\jdjjj.exe71⤵
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\vpvdp.exec:\vpvdp.exe72⤵PID:2312
-
\??\c:\3lxxrxr.exec:\3lxxrxr.exe73⤵PID:1204
-
\??\c:\hbnnnn.exec:\hbnnnn.exe74⤵PID:2640
-
\??\c:\hhnhht.exec:\hhnhht.exe75⤵PID:2488
-
\??\c:\jjvdj.exec:\jjvdj.exe76⤵PID:1664
-
\??\c:\pdppp.exec:\pdppp.exe77⤵PID:2468
-
\??\c:\ffrlxxl.exec:\ffrlxxl.exe78⤵PID:2036
-
\??\c:\fxlrlxl.exec:\fxlrlxl.exe79⤵PID:2740
-
\??\c:\1ttbhn.exec:\1ttbhn.exe80⤵PID:2860
-
\??\c:\nhbbnb.exec:\nhbbnb.exe81⤵PID:2812
-
\??\c:\jjjdv.exec:\jjjdv.exe82⤵PID:2720
-
\??\c:\5rlrlll.exec:\5rlrlll.exe83⤵PID:2736
-
\??\c:\3lxflrf.exec:\3lxflrf.exe84⤵PID:3068
-
\??\c:\bbnbnn.exec:\bbnbnn.exe85⤵PID:2832
-
\??\c:\nhnbbh.exec:\nhnbbh.exe86⤵PID:2696
-
\??\c:\pjvjv.exec:\pjvjv.exe87⤵PID:2876
-
\??\c:\jddjv.exec:\jddjv.exe88⤵PID:1120
-
\??\c:\7fxrrxf.exec:\7fxrrxf.exe89⤵PID:928
-
\??\c:\tbtbnn.exec:\tbtbnn.exe90⤵PID:1480
-
\??\c:\bbthbt.exec:\bbthbt.exe91⤵PID:1720
-
\??\c:\pjvdp.exec:\pjvdp.exe92⤵PID:1756
-
\??\c:\jdvdj.exec:\jdvdj.exe93⤵PID:2768
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe94⤵PID:608
-
\??\c:\rrlxffl.exec:\rrlxffl.exe95⤵PID:2756
-
\??\c:\hhbbnt.exec:\hhbbnt.exe96⤵PID:2000
-
\??\c:\thhnbb.exec:\thhnbb.exe97⤵PID:2936
-
\??\c:\pjpvd.exec:\pjpvd.exe98⤵PID:1328
-
\??\c:\lfffxll.exec:\lfffxll.exe99⤵PID:872
-
\??\c:\tnnbnb.exec:\tnnbnb.exe100⤵PID:1600
-
\??\c:\hbnntb.exec:\hbnntb.exe101⤵PID:2392
-
\??\c:\vppvd.exec:\vppvd.exe102⤵PID:2100
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe103⤵PID:1564
-
\??\c:\3frxllr.exec:\3frxllr.exe104⤵PID:1592
-
\??\c:\nhttth.exec:\nhttth.exe105⤵PID:1804
-
\??\c:\3dpvd.exec:\3dpvd.exe106⤵PID:916
-
\??\c:\dppdj.exec:\dppdj.exe107⤵PID:960
-
\??\c:\xlrllff.exec:\xlrllff.exe108⤵PID:1212
-
\??\c:\5xrxfrl.exec:\5xrxfrl.exe109⤵PID:2116
-
\??\c:\tbhtnh.exec:\tbhtnh.exe110⤵PID:1596
-
\??\c:\9vppj.exec:\9vppj.exe111⤵PID:892
-
\??\c:\7jppv.exec:\7jppv.exe112⤵PID:1280
-
\??\c:\5frfrrl.exec:\5frfrrl.exe113⤵PID:888
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe114⤵PID:2312
-
\??\c:\bththh.exec:\bththh.exe115⤵PID:1204
-
\??\c:\bbnthb.exec:\bbnthb.exe116⤵PID:2640
-
\??\c:\7dvvd.exec:\7dvvd.exe117⤵PID:2488
-
\??\c:\vjvvv.exec:\vjvvv.exe118⤵PID:1664
-
\??\c:\xrlllrr.exec:\xrlllrr.exe119⤵PID:2468
-
\??\c:\nbhhnt.exec:\nbhhnt.exe120⤵PID:2688
-
\??\c:\nhnntn.exec:\nhnntn.exe121⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-