Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 21:05
Behavioral task
behavioral1
Sample
076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe
-
Size
172KB
-
MD5
076b980cd8d1248820d680b4b53dc629
-
SHA1
8b9ff570e0fe56434be15a6923608a5e68607683
-
SHA256
7830b9188d4076b6afe4d45db09b1621d461824c910ba090b421c178a78fa3e8
-
SHA512
a91d75e543a230beba15b3d25967e3e5f3598fcf6bf2c8748a265d2893e8dbc7313479c31497e939f7cd133a9ad6a6473c8b2ced3f057ef5d294b7d2d189b092
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t6NDWOH148BqCFf:kcm4FmowdHoSphraHcpOFltH4ttj8BN
Malware Config
Signatures
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2312-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-38-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-83-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2556-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-90-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2268-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2532-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1344-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-179-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2908-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-197-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-258-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1900-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/620-272-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-293-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/792-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-323-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-435-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2724-438-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2724-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-463-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1748-507-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-559-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2488-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1176-749-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/656-897-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-995-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-1034-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2388-1228-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1296-1244-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2800-1345-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2552-1356-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2836-1371-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 536 1dpvp.exe 380 1rxllfl.exe 2008 9vvvj.exe 2028 frxllrx.exe 2816 9hbntt.exe 2988 rlflxxl.exe 2860 ffflllx.exe 2588 nbhhth.exe 2556 1dpvv.exe 2268 3jjjp.exe 1644 hhnttb.exe 1276 7tnhht.exe 2444 xxrlrxf.exe 2532 llxxfff.exe 552 vpjdj.exe 1440 fxlrrrx.exe 1344 nhthtb.exe 2908 nbhbtb.exe 2424 5vjdj.exe 2388 lfrrlrx.exe 1884 hbntnb.exe 2316 jvpvj.exe 1296 1rrfrxl.exe 1184 lllrxxf.exe 1748 pjdvd.exe 2436 dvvvd.exe 684 lfflrfl.exe 1900 9tnthh.exe 620 vpdjj.exe 2516 rlxxffl.exe 1752 3tnnht.exe 792 hhtbnh.exe 2004 pjdjv.exe 2216 frfflrf.exe 2804 nhbnnt.exe 2700 hbbhth.exe 2580 jdjvp.exe 2988 ffrxrxl.exe 2844 xrfxfrx.exe 2272 ttbntb.exe 2616 vjvdp.exe 1588 pjddp.exe 2664 fxlrrxf.exe 1764 3xrrllr.exe 2056 ttntbh.exe 2020 ddddj.exe 2604 dvpvj.exe 1524 xrffxxl.exe 1260 hhbnht.exe 552 htnhtn.exe 344 ppdjd.exe 2928 llrrflr.exe 2724 ffflxlr.exe 2924 hhbhnn.exe 2200 bttbhn.exe 1308 pjdjv.exe 3012 pjdpd.exe 2956 fxxlxlr.exe 2040 1llxfrf.exe 2404 7bthtb.exe 1784 jdvdd.exe 896 vpjjp.exe 1748 rfrlflr.exe 2436 xrrlrxl.exe -
resource yara_rule behavioral1/memory/2312-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001226d-9.dat upx behavioral1/memory/536-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/536-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001658c-19.dat upx behavioral1/files/0x0007000000016aa9-26.dat upx behavioral1/memory/380-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2008-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c62-36.dat upx behavioral1/files/0x0007000000016c7b-47.dat upx behavioral1/memory/2816-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c84-57.dat upx behavioral1/files/0x0008000000016cfc-66.dat upx behavioral1/memory/2860-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173f4-75.dat upx behavioral1/files/0x00060000000173fc-84.dat upx behavioral1/memory/2556-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-95.dat upx behavioral1/files/0x0006000000017487-103.dat upx behavioral1/memory/2268-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-113-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x00060000000174a2-114.dat upx behavioral1/memory/1644-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-122.dat upx behavioral1/memory/1276-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018663-133.dat upx behavioral1/memory/2444-132-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2532-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001866e-141.dat upx behavioral1/files/0x0005000000018687-150.dat upx behavioral1/memory/552-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018792-160.dat upx behavioral1/memory/1440-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c1a-171.dat upx behavioral1/memory/1344-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-179-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2908-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c26-180.dat upx behavioral1/files/0x0006000000018f53-189.dat upx behavioral1/files/0x000600000001903b-198.dat upx behavioral1/files/0x00060000000190ce-207.dat upx behavioral1/files/0x00060000000190e0-215.dat upx behavioral1/memory/2316-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d4-225.dat upx behavioral1/memory/1296-223-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/files/0x00090000000161f6-233.dat upx behavioral1/files/0x000500000001922c-250.dat upx behavioral1/files/0x00050000000191ff-242.dat upx behavioral1/memory/2436-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019244-259.dat upx behavioral1/memory/1900-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019256-269.dat upx behavioral1/files/0x0005000000019259-277.dat upx behavioral1/files/0x0005000000019263-285.dat upx behavioral1/files/0x0005000000019266-294.dat upx behavioral1/memory/792-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-309-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/2216-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 536 2312 076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe 31 PID 2312 wrote to memory of 536 2312 076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe 31 PID 2312 wrote to memory of 536 2312 076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe 31 PID 2312 wrote to memory of 536 2312 076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe 31 PID 536 wrote to memory of 380 536 1dpvp.exe 32 PID 536 wrote to memory of 380 536 1dpvp.exe 32 PID 536 wrote to memory of 380 536 1dpvp.exe 32 PID 536 wrote to memory of 380 536 1dpvp.exe 32 PID 380 wrote to memory of 2008 380 1rxllfl.exe 33 PID 380 wrote to memory of 2008 380 1rxllfl.exe 33 PID 380 wrote to memory of 2008 380 1rxllfl.exe 33 PID 380 wrote to memory of 2008 380 1rxllfl.exe 33 PID 2008 wrote to memory of 2028 2008 9vvvj.exe 34 PID 2008 wrote to memory of 2028 2008 9vvvj.exe 34 PID 2008 wrote to memory of 2028 2008 9vvvj.exe 34 PID 2008 wrote to memory of 2028 2008 9vvvj.exe 34 PID 2028 wrote to memory of 2816 2028 frxllrx.exe 35 PID 2028 wrote to memory of 2816 2028 frxllrx.exe 35 PID 2028 wrote to memory of 2816 2028 frxllrx.exe 35 PID 2028 wrote to memory of 2816 2028 frxllrx.exe 35 PID 2816 wrote to memory of 2988 2816 9hbntt.exe 36 PID 2816 wrote to memory of 2988 2816 9hbntt.exe 36 PID 2816 wrote to memory of 2988 2816 9hbntt.exe 36 PID 2816 wrote to memory of 2988 2816 9hbntt.exe 36 PID 2988 wrote to memory of 2860 2988 rlflxxl.exe 37 PID 2988 wrote to memory of 2860 2988 rlflxxl.exe 37 PID 2988 wrote to memory of 2860 2988 rlflxxl.exe 37 PID 2988 wrote to memory of 2860 2988 rlflxxl.exe 37 PID 2860 wrote to memory of 2588 2860 ffflllx.exe 38 PID 2860 wrote to memory of 2588 2860 ffflllx.exe 38 PID 2860 wrote to memory of 2588 2860 ffflllx.exe 38 PID 2860 wrote to memory of 2588 2860 ffflllx.exe 38 PID 2588 wrote to memory of 2556 2588 nbhhth.exe 39 PID 2588 wrote to memory of 2556 2588 nbhhth.exe 39 PID 2588 wrote to memory of 2556 2588 nbhhth.exe 39 PID 2588 wrote to memory of 2556 2588 nbhhth.exe 39 PID 2556 wrote to memory of 2268 2556 1dpvv.exe 40 PID 2556 wrote to memory of 2268 2556 1dpvv.exe 40 PID 2556 wrote to memory of 2268 2556 1dpvv.exe 40 PID 2556 wrote to memory of 2268 2556 1dpvv.exe 40 PID 2268 wrote to memory of 1644 2268 3jjjp.exe 41 PID 2268 wrote to memory of 1644 2268 3jjjp.exe 41 PID 2268 wrote to memory of 1644 2268 3jjjp.exe 41 PID 2268 wrote to memory of 1644 2268 3jjjp.exe 41 PID 1644 wrote to memory of 1276 1644 hhnttb.exe 42 PID 1644 wrote to memory of 1276 1644 hhnttb.exe 42 PID 1644 wrote to memory of 1276 1644 hhnttb.exe 42 PID 1644 wrote to memory of 1276 1644 hhnttb.exe 42 PID 1276 wrote to memory of 2444 1276 7tnhht.exe 43 PID 1276 wrote to memory of 2444 1276 7tnhht.exe 43 PID 1276 wrote to memory of 2444 1276 7tnhht.exe 43 PID 1276 wrote to memory of 2444 1276 7tnhht.exe 43 PID 2444 wrote to memory of 2532 2444 xxrlrxf.exe 44 PID 2444 wrote to memory of 2532 2444 xxrlrxf.exe 44 PID 2444 wrote to memory of 2532 2444 xxrlrxf.exe 44 PID 2444 wrote to memory of 2532 2444 xxrlrxf.exe 44 PID 2532 wrote to memory of 552 2532 llxxfff.exe 45 PID 2532 wrote to memory of 552 2532 llxxfff.exe 45 PID 2532 wrote to memory of 552 2532 llxxfff.exe 45 PID 2532 wrote to memory of 552 2532 llxxfff.exe 45 PID 552 wrote to memory of 1440 552 vpjdj.exe 46 PID 552 wrote to memory of 1440 552 vpjdj.exe 46 PID 552 wrote to memory of 1440 552 vpjdj.exe 46 PID 552 wrote to memory of 1440 552 vpjdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\076b980cd8d1248820d680b4b53dc629_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\1dpvp.exec:\1dpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\1rxllfl.exec:\1rxllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\9vvvj.exec:\9vvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\frxllrx.exec:\frxllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9hbntt.exec:\9hbntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlflxxl.exec:\rlflxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ffflllx.exec:\ffflllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nbhhth.exec:\nbhhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1dpvv.exec:\1dpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3jjjp.exec:\3jjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\hhnttb.exec:\hhnttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\7tnhht.exec:\7tnhht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\xxrlrxf.exec:\xxrlrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\llxxfff.exec:\llxxfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\vpjdj.exec:\vpjdj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhthtb.exec:\nhthtb.exe18⤵
- Executes dropped EXE
PID:1344 -
\??\c:\nbhbtb.exec:\nbhbtb.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5vjdj.exec:\5vjdj.exe20⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lfrrlrx.exec:\lfrrlrx.exe21⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hbntnb.exec:\hbntnb.exe22⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jvpvj.exec:\jvpvj.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1rrfrxl.exec:\1rrfrxl.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lllrxxf.exec:\lllrxxf.exe25⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pjdvd.exec:\pjdvd.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvvvd.exec:\dvvvd.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lfflrfl.exec:\lfflrfl.exe28⤵
- Executes dropped EXE
PID:684 -
\??\c:\9tnthh.exec:\9tnthh.exe29⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vpdjj.exec:\vpdjj.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\rlxxffl.exec:\rlxxffl.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3tnnht.exec:\3tnnht.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hhtbnh.exec:\hhtbnh.exe33⤵
- Executes dropped EXE
PID:792 -
\??\c:\pjdjv.exec:\pjdjv.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frfflrf.exec:\frfflrf.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhbnnt.exec:\nhbnnt.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbbhth.exec:\hbbhth.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdjvp.exec:\jdjvp.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ttbntb.exec:\ttbntb.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vjvdp.exec:\vjvdp.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjddp.exec:\pjddp.exe43⤵
- Executes dropped EXE
PID:1588 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3xrrllr.exec:\3xrrllr.exe45⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ttntbh.exec:\ttntbh.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ddddj.exec:\ddddj.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dvpvj.exec:\dvpvj.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrffxxl.exec:\xrffxxl.exe49⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hhbnht.exec:\hhbnht.exe50⤵
- Executes dropped EXE
PID:1260 -
\??\c:\htnhtn.exec:\htnhtn.exe51⤵
- Executes dropped EXE
PID:552 -
\??\c:\ppdjd.exec:\ppdjd.exe52⤵
- Executes dropped EXE
PID:344 -
\??\c:\llrrflr.exec:\llrrflr.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ffflxlr.exec:\ffflxlr.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhbhnn.exec:\hhbhnn.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bttbhn.exec:\bttbhn.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjdjv.exec:\pjdjv.exe57⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pjdpd.exec:\pjdpd.exe58⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fxxlxlr.exec:\fxxlxlr.exe59⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1llxfrf.exec:\1llxfrf.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7bthtb.exec:\7bthtb.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdvdd.exec:\jdvdd.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpjjp.exec:\vpjjp.exe63⤵
- Executes dropped EXE
PID:896 -
\??\c:\rfrlflr.exec:\rfrlflr.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xrrlrxl.exec:\xrrlrxl.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbhthb.exec:\tbhthb.exe66⤵PID:980
-
\??\c:\tnhnbh.exec:\tnhnbh.exe67⤵PID:2428
-
\??\c:\pjpvj.exec:\pjpvj.exe68⤵PID:1520
-
\??\c:\fxlxllx.exec:\fxlxllx.exe69⤵PID:1504
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe70⤵PID:2064
-
\??\c:\hbnbnt.exec:\hbnbnt.exe71⤵PID:1600
-
\??\c:\nnhbhn.exec:\nnhbhn.exe72⤵PID:2896
-
\??\c:\ppjvd.exec:\ppjvd.exe73⤵PID:2488
-
\??\c:\5dvjv.exec:\5dvjv.exe74⤵PID:2004
-
\??\c:\3xllxfx.exec:\3xllxfx.exe75⤵PID:2008
-
\??\c:\1fxfrxl.exec:\1fxfrxl.exe76⤵PID:2800
-
\??\c:\9bthhn.exec:\9bthhn.exe77⤵PID:2816
-
\??\c:\7vvvd.exec:\7vvvd.exe78⤵PID:2180
-
\??\c:\vjddp.exec:\vjddp.exe79⤵PID:2568
-
\??\c:\1rfflll.exec:\1rfflll.exe80⤵PID:2828
-
\??\c:\xrllxxf.exec:\xrllxxf.exe81⤵PID:2608
-
\??\c:\hbnbnn.exec:\hbnbnn.exe82⤵PID:3068
-
\??\c:\nnhbnh.exec:\nnhbnh.exe83⤵PID:3060
-
\??\c:\vpppp.exec:\vpppp.exe84⤵PID:2276
-
\??\c:\jjjpv.exec:\jjjpv.exe85⤵PID:1140
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe86⤵PID:1488
-
\??\c:\ffrrffr.exec:\ffrrffr.exe87⤵PID:808
-
\??\c:\bbbtbt.exec:\bbbtbt.exe88⤵PID:2748
-
\??\c:\7hhhnb.exec:\7hhhnb.exe89⤵PID:2604
-
\??\c:\vvvpv.exec:\vvvpv.exe90⤵PID:2772
-
\??\c:\9dvvd.exec:\9dvvd.exe91⤵PID:2868
-
\??\c:\rlxlxrr.exec:\rlxlxrr.exe92⤵PID:2900
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe93⤵PID:348
-
\??\c:\nnbbtt.exec:\nnbbtt.exe94⤵PID:2916
-
\??\c:\hbnhnn.exec:\hbnhnn.exe95⤵PID:2940
-
\??\c:\jdjpv.exec:\jdjpv.exe96⤵PID:2160
-
\??\c:\9pjvj.exec:\9pjvj.exe97⤵PID:3048
-
\??\c:\lxxlxxx.exec:\lxxlxxx.exe98⤵PID:2388
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe99⤵PID:1884
-
\??\c:\bhbnht.exec:\bhbnht.exe100⤵PID:1724
-
\??\c:\pjdjp.exec:\pjdjp.exe101⤵PID:2956
-
\??\c:\jjdjd.exec:\jjdjd.exe102⤵PID:2040
-
\??\c:\frrlxxx.exec:\frrlxxx.exe103⤵PID:1176
-
\??\c:\xxrrlxf.exec:\xxrrlxf.exe104⤵PID:768
-
\??\c:\btnthn.exec:\btnthn.exe105⤵PID:896
-
\??\c:\nhtbnt.exec:\nhtbnt.exe106⤵PID:1500
-
\??\c:\9pjpv.exec:\9pjpv.exe107⤵PID:2436
-
\??\c:\jjdvd.exec:\jjdvd.exe108⤵PID:2100
-
\??\c:\xxxxfxl.exec:\xxxxfxl.exe109⤵PID:1820
-
\??\c:\ttttnn.exec:\ttttnn.exe110⤵PID:2332
-
\??\c:\bbhthh.exec:\bbhthh.exe111⤵PID:2312
-
\??\c:\pppdj.exec:\pppdj.exe112⤵PID:2980
-
\??\c:\vjddj.exec:\vjddj.exe113⤵PID:644
-
\??\c:\rllrxll.exec:\rllrxll.exe114⤵PID:380
-
\??\c:\5lxxflf.exec:\5lxxflf.exe115⤵PID:2732
-
\??\c:\bththn.exec:\bththn.exe116⤵
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\1hbnhh.exec:\1hbnhh.exe117⤵PID:2672
-
\??\c:\jppjp.exec:\jppjp.exe118⤵PID:2676
-
\??\c:\vpjjv.exec:\vpjjv.exe119⤵PID:2820
-
\??\c:\7rfxflx.exec:\7rfxflx.exe120⤵PID:2952
-
\??\c:\9llxffx.exec:\9llxffx.exe121⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-