Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe
-
Size
76KB
-
MD5
56c815ec26cacd728c009d4bf1fb4c4e
-
SHA1
571e1cf81f8105e2d33ed0bbe26ab8ea3879cb0f
-
SHA256
efb7a67bd171bb0039de2d6cb871c2f368ac4f5bf134e38f412b5652457820b1
-
SHA512
4f1fa1c8b7497394517cb32489a9ddbbf3f20696bbd1a1068e19d47f4465c09f5fc6fe2241c160346de35d7827d976b75c2dea023de51c11530870cbed28ff26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpiZBf7+JB46m:ymb3NkkiQ3mdBjFIjZsJu
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4800-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4148 frxflll.exe 2816 bhbhtb.exe 3716 pjdvv.exe 3804 vddpd.exe 3192 7rxxrrl.exe 380 frrlfxr.exe 728 btbtnn.exe 4720 pjjdp.exe 1440 3flfxrl.exe 2304 bhnnhb.exe 948 dvpjj.exe 2604 xrrrlll.exe 5080 xrxrxrf.exe 2292 1nbnnh.exe 4396 nhbtnn.exe 2284 lrfxrrl.exe 1132 5xxrfxl.exe 1436 bbhtht.exe 2524 jdjjv.exe 2876 7jppd.exe 1152 ffxrfxl.exe 1792 ththhb.exe 2460 vjdvj.exe 4944 9vvjv.exe 2276 7lrlxrl.exe 532 tnnnhh.exe 3984 jjppj.exe 4736 rlrrllr.exe 4636 rxlfrrl.exe 3104 tttthh.exe 2416 jddvj.exe 3136 rrrfrfl.exe 1640 bhthbn.exe 2964 vvppj.exe 4152 1rxrrrr.exe 3612 7xlfffr.exe 2592 tntthh.exe 1952 5djdv.exe 4188 dvdvp.exe 2884 9xrxxxx.exe 652 thnnnn.exe 4484 vjjjd.exe 3188 jjpvp.exe 4276 1fxfxll.exe 432 flflrxl.exe 2440 bnbttb.exe 2304 5jvpv.exe 1940 1jppj.exe 1576 fxfxxxx.exe 4176 7rrrlxf.exe 1996 5nnhhh.exe 3356 ttbbnh.exe 2404 5vddj.exe 2032 vjdvp.exe 684 3lllffx.exe 5116 tnnbtb.exe 3008 btnhbt.exe 2872 jvdjp.exe 2876 ddvpp.exe 4376 xfxllxl.exe 4056 7nhbtt.exe 1792 tthhtt.exe 4712 bhnntb.exe 3568 3jddj.exe -
resource yara_rule behavioral2/memory/4800-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4148 4800 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 84 PID 4800 wrote to memory of 4148 4800 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 84 PID 4800 wrote to memory of 4148 4800 56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe 84 PID 4148 wrote to memory of 2816 4148 frxflll.exe 85 PID 4148 wrote to memory of 2816 4148 frxflll.exe 85 PID 4148 wrote to memory of 2816 4148 frxflll.exe 85 PID 2816 wrote to memory of 3716 2816 bhbhtb.exe 86 PID 2816 wrote to memory of 3716 2816 bhbhtb.exe 86 PID 2816 wrote to memory of 3716 2816 bhbhtb.exe 86 PID 3716 wrote to memory of 3804 3716 pjdvv.exe 87 PID 3716 wrote to memory of 3804 3716 pjdvv.exe 87 PID 3716 wrote to memory of 3804 3716 pjdvv.exe 87 PID 3804 wrote to memory of 3192 3804 vddpd.exe 88 PID 3804 wrote to memory of 3192 3804 vddpd.exe 88 PID 3804 wrote to memory of 3192 3804 vddpd.exe 88 PID 3192 wrote to memory of 380 3192 7rxxrrl.exe 89 PID 3192 wrote to memory of 380 3192 7rxxrrl.exe 89 PID 3192 wrote to memory of 380 3192 7rxxrrl.exe 89 PID 380 wrote to memory of 728 380 frrlfxr.exe 90 PID 380 wrote to memory of 728 380 frrlfxr.exe 90 PID 380 wrote to memory of 728 380 frrlfxr.exe 90 PID 728 wrote to memory of 4720 728 btbtnn.exe 91 PID 728 wrote to memory of 4720 728 btbtnn.exe 91 PID 728 wrote to memory of 4720 728 btbtnn.exe 91 PID 4720 wrote to memory of 1440 4720 pjjdp.exe 92 PID 4720 wrote to memory of 1440 4720 pjjdp.exe 92 PID 4720 wrote to memory of 1440 4720 pjjdp.exe 92 PID 1440 wrote to memory of 2304 1440 3flfxrl.exe 93 PID 1440 wrote to memory of 2304 1440 3flfxrl.exe 93 PID 1440 wrote to memory of 2304 1440 3flfxrl.exe 93 PID 2304 wrote to memory of 948 2304 bhnnhb.exe 94 PID 2304 wrote to memory of 948 2304 bhnnhb.exe 94 PID 2304 wrote to memory of 948 2304 bhnnhb.exe 94 PID 948 wrote to memory of 2604 948 dvpjj.exe 95 PID 948 wrote to memory of 2604 948 dvpjj.exe 95 PID 948 wrote to memory of 2604 948 dvpjj.exe 95 PID 2604 wrote to memory of 5080 2604 xrrrlll.exe 96 PID 2604 wrote to memory of 5080 2604 xrrrlll.exe 96 PID 2604 wrote to memory of 5080 2604 xrrrlll.exe 96 PID 5080 wrote to memory of 2292 5080 xrxrxrf.exe 97 PID 5080 wrote to memory of 2292 5080 xrxrxrf.exe 97 PID 5080 wrote to memory of 2292 5080 xrxrxrf.exe 97 PID 2292 wrote to memory of 4396 2292 1nbnnh.exe 98 PID 2292 wrote to memory of 4396 2292 1nbnnh.exe 98 PID 2292 wrote to memory of 4396 2292 1nbnnh.exe 98 PID 4396 wrote to memory of 2284 4396 nhbtnn.exe 99 PID 4396 wrote to memory of 2284 4396 nhbtnn.exe 99 PID 4396 wrote to memory of 2284 4396 nhbtnn.exe 99 PID 2284 wrote to memory of 1132 2284 lrfxrrl.exe 100 PID 2284 wrote to memory of 1132 2284 lrfxrrl.exe 100 PID 2284 wrote to memory of 1132 2284 lrfxrrl.exe 100 PID 1132 wrote to memory of 1436 1132 5xxrfxl.exe 101 PID 1132 wrote to memory of 1436 1132 5xxrfxl.exe 101 PID 1132 wrote to memory of 1436 1132 5xxrfxl.exe 101 PID 1436 wrote to memory of 2524 1436 bbhtht.exe 102 PID 1436 wrote to memory of 2524 1436 bbhtht.exe 102 PID 1436 wrote to memory of 2524 1436 bbhtht.exe 102 PID 2524 wrote to memory of 2876 2524 jdjjv.exe 103 PID 2524 wrote to memory of 2876 2524 jdjjv.exe 103 PID 2524 wrote to memory of 2876 2524 jdjjv.exe 103 PID 2876 wrote to memory of 1152 2876 7jppd.exe 105 PID 2876 wrote to memory of 1152 2876 7jppd.exe 105 PID 2876 wrote to memory of 1152 2876 7jppd.exe 105 PID 1152 wrote to memory of 1792 1152 ffxrfxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\56c815ec26cacd728c009d4bf1fb4c4e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\frxflll.exec:\frxflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\bhbhtb.exec:\bhbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjdvv.exec:\pjdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\vddpd.exec:\vddpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\7rxxrrl.exec:\7rxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\frrlfxr.exec:\frrlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\btbtnn.exec:\btbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\pjjdp.exec:\pjjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\3flfxrl.exec:\3flfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\bhnnhb.exec:\bhnnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dvpjj.exec:\dvpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\xrrrlll.exec:\xrrrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xrxrxrf.exec:\xrxrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\1nbnnh.exec:\1nbnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\nhbtnn.exec:\nhbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5xxrfxl.exec:\5xxrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\bbhtht.exec:\bbhtht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jdjjv.exec:\jdjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7jppd.exec:\7jppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ffxrfxl.exec:\ffxrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ththhb.exec:\ththhb.exe23⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vjdvj.exec:\vjdvj.exe24⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9vvjv.exec:\9vvjv.exe25⤵
- Executes dropped EXE
PID:4944 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe26⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tnnnhh.exec:\tnnnhh.exe27⤵
- Executes dropped EXE
PID:532 -
\??\c:\jjppj.exec:\jjppj.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
\??\c:\rlrrllr.exec:\rlrrllr.exe29⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe30⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tttthh.exec:\tttthh.exe31⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jddvj.exec:\jddvj.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rrrfrfl.exec:\rrrfrfl.exe33⤵
- Executes dropped EXE
PID:3136 -
\??\c:\bhthbn.exec:\bhthbn.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvppj.exec:\vvppj.exe35⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1rxrrrr.exec:\1rxrrrr.exe36⤵
- Executes dropped EXE
PID:4152 -
\??\c:\7xlfffr.exec:\7xlfffr.exe37⤵
- Executes dropped EXE
PID:3612 -
\??\c:\tntthh.exec:\tntthh.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5djdv.exec:\5djdv.exe39⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dvdvp.exec:\dvdvp.exe40⤵
- Executes dropped EXE
PID:4188 -
\??\c:\9xrxxxx.exec:\9xrxxxx.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\thnnnn.exec:\thnnnn.exe42⤵
- Executes dropped EXE
PID:652 -
\??\c:\vjjjd.exec:\vjjjd.exe43⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jjpvp.exec:\jjpvp.exe44⤵
- Executes dropped EXE
PID:3188 -
\??\c:\1fxfxll.exec:\1fxfxll.exe45⤵
- Executes dropped EXE
PID:4276 -
\??\c:\flflrxl.exec:\flflrxl.exe46⤵
- Executes dropped EXE
PID:432 -
\??\c:\bnbttb.exec:\bnbttb.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5jvpv.exec:\5jvpv.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1jppj.exec:\1jppj.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7rrrlxf.exec:\7rrrlxf.exe51⤵
- Executes dropped EXE
PID:4176 -
\??\c:\5nnhhh.exec:\5nnhhh.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ttbbnh.exec:\ttbbnh.exe53⤵
- Executes dropped EXE
PID:3356 -
\??\c:\5vddj.exec:\5vddj.exe54⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vjdvp.exec:\vjdvp.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3lllffx.exec:\3lllffx.exe56⤵
- Executes dropped EXE
PID:684 -
\??\c:\tnnbtb.exec:\tnnbtb.exe57⤵
- Executes dropped EXE
PID:5116 -
\??\c:\btnhbt.exec:\btnhbt.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jvdjp.exec:\jvdjp.exe59⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddvpp.exec:\ddvpp.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xfxllxl.exec:\xfxllxl.exe61⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7nhbtt.exec:\7nhbtt.exe62⤵
- Executes dropped EXE
PID:4056 -
\??\c:\tthhtt.exec:\tthhtt.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bhnntb.exec:\bhnntb.exe64⤵
- Executes dropped EXE
PID:4712 -
\??\c:\3jddj.exec:\3jddj.exe65⤵
- Executes dropped EXE
PID:3568 -
\??\c:\djjvj.exec:\djjvj.exe66⤵PID:4924
-
\??\c:\fxrxffx.exec:\fxrxffx.exe67⤵PID:2836
-
\??\c:\btbbbh.exec:\btbbbh.exe68⤵PID:3964
-
\??\c:\hhhbtn.exec:\hhhbtn.exe69⤵PID:1928
-
\??\c:\ppvpd.exec:\ppvpd.exe70⤵PID:2560
-
\??\c:\ddppp.exec:\ddppp.exe71⤵PID:1808
-
\??\c:\rllllll.exec:\rllllll.exe72⤵PID:2952
-
\??\c:\lflxxll.exec:\lflxxll.exe73⤵PID:3660
-
\??\c:\ttnnnh.exec:\ttnnnh.exe74⤵PID:4572
-
\??\c:\hnnbbh.exec:\hnnbbh.exe75⤵PID:4308
-
\??\c:\ddjjj.exec:\ddjjj.exe76⤵PID:3344
-
\??\c:\flrrllf.exec:\flrrllf.exe77⤵PID:1452
-
\??\c:\1rrlflf.exec:\1rrlflf.exe78⤵PID:4500
-
\??\c:\9thhbb.exec:\9thhbb.exe79⤵PID:3976
-
\??\c:\ppppp.exec:\ppppp.exe80⤵PID:2592
-
\??\c:\7rrllll.exec:\7rrllll.exe81⤵PID:1952
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe82⤵PID:4188
-
\??\c:\bbntnn.exec:\bbntnn.exe83⤵PID:4536
-
\??\c:\nhhnnt.exec:\nhhnnt.exe84⤵PID:4620
-
\??\c:\jddvp.exec:\jddvp.exe85⤵PID:2880
-
\??\c:\xrllrxr.exec:\xrllrxr.exe86⤵PID:4720
-
\??\c:\rxrfffl.exec:\rxrfffl.exe87⤵PID:428
-
\??\c:\hnntbn.exec:\hnntbn.exe88⤵PID:880
-
\??\c:\7jvdj.exec:\7jvdj.exe89⤵PID:1584
-
\??\c:\1llffll.exec:\1llffll.exe90⤵PID:1160
-
\??\c:\frrlflf.exec:\frrlflf.exe91⤵PID:2700
-
\??\c:\nbtnnh.exec:\nbtnnh.exe92⤵PID:2684
-
\??\c:\nhtttn.exec:\nhtttn.exe93⤵PID:4140
-
\??\c:\djvvp.exec:\djvvp.exe94⤵PID:3356
-
\??\c:\xflfxll.exec:\xflfxll.exe95⤵PID:2404
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe96⤵PID:2032
-
\??\c:\bbtnhh.exec:\bbtnhh.exe97⤵PID:684
-
\??\c:\nhbbtn.exec:\nhbbtn.exe98⤵PID:1748
-
\??\c:\jpddd.exec:\jpddd.exe99⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\3fllfrr.exec:\3fllfrr.exe100⤵PID:1416
-
\??\c:\lrrxlxl.exec:\lrrxlxl.exe101⤵PID:4756
-
\??\c:\7hhntb.exec:\7hhntb.exe102⤵PID:4508
-
\??\c:\tntbbb.exec:\tntbbb.exe103⤵PID:2840
-
\??\c:\jpvvv.exec:\jpvvv.exe104⤵PID:1792
-
\??\c:\dvddj.exec:\dvddj.exe105⤵PID:3944
-
\??\c:\5xxfxff.exec:\5xxfxff.exe106⤵PID:2276
-
\??\c:\xflfxxr.exec:\xflfxxr.exe107⤵PID:2084
-
\??\c:\nttnht.exec:\nttnht.exe108⤵PID:3296
-
\??\c:\ddjpj.exec:\ddjpj.exe109⤵PID:3964
-
\??\c:\jvvvv.exec:\jvvvv.exe110⤵PID:4084
-
\??\c:\xlfflll.exec:\xlfflll.exe111⤵PID:2892
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe112⤵PID:4796
-
\??\c:\nbhhhh.exec:\nbhhhh.exe113⤵PID:4700
-
\??\c:\vdvpd.exec:\vdvpd.exe114⤵PID:1528
-
\??\c:\fffxxxl.exec:\fffxxxl.exe115⤵PID:3060
-
\??\c:\3rlrlfl.exec:\3rlrlfl.exe116⤵PID:4448
-
\??\c:\rffxrfx.exec:\rffxrfx.exe117⤵PID:3508
-
\??\c:\5bbnhb.exec:\5bbnhb.exe118⤵PID:3612
-
\??\c:\hbbnnh.exec:\hbbnnh.exe119⤵PID:2380
-
\??\c:\7jjjj.exec:\7jjjj.exe120⤵PID:2112
-
\??\c:\5ddjd.exec:\5ddjd.exe121⤵PID:836
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe122⤵PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-