Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe
-
Size
456KB
-
MD5
0c02684a7a7b494619ecb05e101ddaca
-
SHA1
2530b6fa799b0215adefa51fa6a886241539e652
-
SHA256
86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84
-
SHA512
95ea1dbe1b9ec6c8a1f351dacf429746809531306a01cb901cc61563ced574ee0520ae38fad4b895e3044f8104727c4431fff89c8aa2c7bea6c1efb254f947d3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-144-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2668-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-461-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2376-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-585-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2716-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-816-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/988-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-1015-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-1020-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/608-1066-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-1099-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1212 rrflxfr.exe 2332 vvjvj.exe 2464 flxflrf.exe 3004 bhttnb.exe 2860 3jjpd.exe 2184 bnbtbb.exe 1964 5dpdd.exe 2688 7fffrxl.exe 2736 lrlxrxf.exe 2596 9frrflx.exe 2720 ppjpp.exe 1452 nthnhn.exe 2660 tnnbbt.exe 1132 jjvvd.exe 2420 vjjdd.exe 2668 vvjvd.exe 2948 1flrfll.exe 2940 llrxfxr.exe 580 bbntht.exe 2144 lrrrrlx.exe 544 rxlfrxf.exe 2580 pdvpp.exe 292 xfrlfxx.exe 1240 jdjjj.exe 1244 7lrllll.exe 3032 jjvjj.exe 1692 vvddd.exe 2088 jvvvp.exe 1728 7lffrrl.exe 1900 bnhhtb.exe 2416 vjdvj.exe 1760 3bthbn.exe 1888 jpdjv.exe 2324 lrrxrrx.exe 1600 nnbhtb.exe 2312 jpvjp.exe 2492 rxffrfx.exe 2368 tbnnhh.exe 2464 vvjvj.exe 2880 pjpdv.exe 2868 7rlrfrx.exe 2184 bntthb.exe 2608 pvppj.exe 1932 lrflfrf.exe 2044 hbtbth.exe 2896 htthhb.exe 2620 pdpvj.exe 2024 xlfrlrf.exe 1984 nbtbhh.exe 2204 pddvv.exe 2776 vjvdd.exe 2660 xxlfxll.exe 1340 hnhtht.exe 1112 pvvjv.exe 1868 rffflxf.exe 3000 bbtbnt.exe 2992 nbhnbh.exe 2428 5jdjj.exe 2376 flxfffx.exe 2068 bbhtnt.exe 1040 5ppvp.exe 2584 9lfflrf.exe 956 llflxlf.exe 448 hbbnnh.exe -
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-634-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2604-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-672-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2776-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-816-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2312-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxflrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 1212 2084 86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe 30 PID 2084 wrote to memory of 1212 2084 86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe 30 PID 2084 wrote to memory of 1212 2084 86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe 30 PID 2084 wrote to memory of 1212 2084 86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe 30 PID 1212 wrote to memory of 2332 1212 rrflxfr.exe 31 PID 1212 wrote to memory of 2332 1212 rrflxfr.exe 31 PID 1212 wrote to memory of 2332 1212 rrflxfr.exe 31 PID 1212 wrote to memory of 2332 1212 rrflxfr.exe 31 PID 2332 wrote to memory of 2464 2332 vvjvj.exe 32 PID 2332 wrote to memory of 2464 2332 vvjvj.exe 32 PID 2332 wrote to memory of 2464 2332 vvjvj.exe 32 PID 2332 wrote to memory of 2464 2332 vvjvj.exe 32 PID 2464 wrote to memory of 3004 2464 flxflrf.exe 33 PID 2464 wrote to memory of 3004 2464 flxflrf.exe 33 PID 2464 wrote to memory of 3004 2464 flxflrf.exe 33 PID 2464 wrote to memory of 3004 2464 flxflrf.exe 33 PID 3004 wrote to memory of 2860 3004 bhttnb.exe 34 PID 3004 wrote to memory of 2860 3004 bhttnb.exe 34 PID 3004 wrote to memory of 2860 3004 bhttnb.exe 34 PID 3004 wrote to memory of 2860 3004 bhttnb.exe 34 PID 2860 wrote to memory of 2184 2860 3jjpd.exe 35 PID 2860 wrote to memory of 2184 2860 3jjpd.exe 35 PID 2860 wrote to memory of 2184 2860 3jjpd.exe 35 PID 2860 wrote to memory of 2184 2860 3jjpd.exe 35 PID 2184 wrote to memory of 1964 2184 bnbtbb.exe 36 PID 2184 wrote to memory of 1964 2184 bnbtbb.exe 36 PID 2184 wrote to memory of 1964 2184 bnbtbb.exe 36 PID 2184 wrote to memory of 1964 2184 bnbtbb.exe 36 PID 1964 wrote to memory of 2688 1964 5dpdd.exe 37 PID 1964 wrote to memory of 2688 1964 5dpdd.exe 37 PID 1964 wrote to memory of 2688 1964 5dpdd.exe 37 PID 1964 wrote to memory of 2688 1964 5dpdd.exe 37 PID 2688 wrote to memory of 2736 2688 7fffrxl.exe 38 PID 2688 wrote to memory of 2736 2688 7fffrxl.exe 38 PID 2688 wrote to memory of 2736 2688 7fffrxl.exe 38 PID 2688 wrote to memory of 2736 2688 7fffrxl.exe 38 PID 2736 wrote to memory of 2596 2736 lrlxrxf.exe 39 PID 2736 wrote to memory of 2596 2736 lrlxrxf.exe 39 PID 2736 wrote to memory of 2596 2736 lrlxrxf.exe 39 PID 2736 wrote to memory of 2596 2736 lrlxrxf.exe 39 PID 2596 wrote to memory of 2720 2596 9frrflx.exe 40 PID 2596 wrote to memory of 2720 2596 9frrflx.exe 40 PID 2596 wrote to memory of 2720 2596 9frrflx.exe 40 PID 2596 wrote to memory of 2720 2596 9frrflx.exe 40 PID 2720 wrote to memory of 1452 2720 ppjpp.exe 41 PID 2720 wrote to memory of 1452 2720 ppjpp.exe 41 PID 2720 wrote to memory of 1452 2720 ppjpp.exe 41 PID 2720 wrote to memory of 1452 2720 ppjpp.exe 41 PID 1452 wrote to memory of 2660 1452 nthnhn.exe 42 PID 1452 wrote to memory of 2660 1452 nthnhn.exe 42 PID 1452 wrote to memory of 2660 1452 nthnhn.exe 42 PID 1452 wrote to memory of 2660 1452 nthnhn.exe 42 PID 2660 wrote to memory of 1132 2660 tnnbbt.exe 43 PID 2660 wrote to memory of 1132 2660 tnnbbt.exe 43 PID 2660 wrote to memory of 1132 2660 tnnbbt.exe 43 PID 2660 wrote to memory of 1132 2660 tnnbbt.exe 43 PID 1132 wrote to memory of 2420 1132 jjvvd.exe 44 PID 1132 wrote to memory of 2420 1132 jjvvd.exe 44 PID 1132 wrote to memory of 2420 1132 jjvvd.exe 44 PID 1132 wrote to memory of 2420 1132 jjvvd.exe 44 PID 2420 wrote to memory of 2668 2420 vjjdd.exe 45 PID 2420 wrote to memory of 2668 2420 vjjdd.exe 45 PID 2420 wrote to memory of 2668 2420 vjjdd.exe 45 PID 2420 wrote to memory of 2668 2420 vjjdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe"C:\Users\Admin\AppData\Local\Temp\86ce64183879b612c64af37bb9f348c7eb005f69c06bbccfc613f874dd6d1f84.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rrflxfr.exec:\rrflxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\vvjvj.exec:\vvjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\flxflrf.exec:\flxflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\bhttnb.exec:\bhttnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3jjpd.exec:\3jjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bnbtbb.exec:\bnbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\5dpdd.exec:\5dpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\7fffrxl.exec:\7fffrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrlxrxf.exec:\lrlxrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9frrflx.exec:\9frrflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ppjpp.exec:\ppjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nthnhn.exec:\nthnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\tnnbbt.exec:\tnnbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jjvvd.exec:\jjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vjjdd.exec:\vjjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vvjvd.exec:\vvjvd.exe17⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1flrfll.exec:\1flrfll.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\llrxfxr.exec:\llrxfxr.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbntht.exec:\bbntht.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\lrrrrlx.exec:\lrrrrlx.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rxlfrxf.exec:\rxlfrxf.exe22⤵
- Executes dropped EXE
PID:544 -
\??\c:\pdvpp.exec:\pdvpp.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe24⤵
- Executes dropped EXE
PID:292 -
\??\c:\jdjjj.exec:\jdjjj.exe25⤵
- Executes dropped EXE
PID:1240 -
\??\c:\7lrllll.exec:\7lrllll.exe26⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jjvjj.exec:\jjvjj.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vvddd.exec:\vvddd.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jvvvp.exec:\jvvvp.exe29⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7lffrrl.exec:\7lffrrl.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bnhhtb.exec:\bnhhtb.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vjdvj.exec:\vjdvj.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3bthbn.exec:\3bthbn.exe33⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jpdjv.exec:\jpdjv.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lrrxrrx.exec:\lrrxrrx.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nnbhtb.exec:\nnbhtb.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jpvjp.exec:\jpvjp.exe37⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rxffrfx.exec:\rxffrfx.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tbnnhh.exec:\tbnnhh.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvjvj.exec:\vvjvj.exe40⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pjpdv.exec:\pjpdv.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7rlrfrx.exec:\7rlrfrx.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bntthb.exec:\bntthb.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pvppj.exec:\pvppj.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lrflfrf.exec:\lrflfrf.exe45⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hbtbth.exec:\hbtbth.exe46⤵
- Executes dropped EXE
PID:2044 -
\??\c:\htthhb.exec:\htthhb.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdpvj.exec:\pdpvj.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xlfrlrf.exec:\xlfrlrf.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nbtbhh.exec:\nbtbhh.exe50⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pddvv.exec:\pddvv.exe51⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vjvdd.exec:\vjvdd.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxlfxll.exec:\xxlfxll.exe53⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hnhtht.exec:\hnhtht.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\pvvjv.exec:\pvvjv.exe55⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rffflxf.exec:\rffflxf.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bbtbnt.exec:\bbtbnt.exe57⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nbhnbh.exec:\nbhnbh.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5jdjj.exec:\5jdjj.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\flxfffx.exec:\flxfffx.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bbhtnt.exec:\bbhtnt.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\5ppvp.exec:\5ppvp.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9lfflrf.exec:\9lfflrf.exe63⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llflxlf.exec:\llflxlf.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\hbbnnh.exec:\hbbnnh.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\vjpdp.exec:\vjpdp.exe66⤵PID:2976
-
\??\c:\xflxfrf.exec:\xflxfrf.exe67⤵PID:1756
-
\??\c:\hhtbtb.exec:\hhtbtb.exe68⤵PID:760
-
\??\c:\vvvpp.exec:\vvvpp.exe69⤵PID:2460
-
\??\c:\5fxxlfr.exec:\5fxxlfr.exe70⤵PID:2456
-
\??\c:\nnbhnb.exec:\nnbhnb.exe71⤵PID:1912
-
\??\c:\tnnhnh.exec:\tnnhnh.exe72⤵PID:1752
-
\??\c:\vdpvj.exec:\vdpvj.exe73⤵PID:2476
-
\??\c:\rrffrfr.exec:\rrffrfr.exe74⤵PID:992
-
\??\c:\5bthth.exec:\5bthth.exe75⤵PID:876
-
\??\c:\dppjv.exec:\dppjv.exe76⤵PID:2076
-
\??\c:\1dpdp.exec:\1dpdp.exe77⤵PID:2576
-
\??\c:\xfxlxlf.exec:\xfxlxlf.exe78⤵PID:1604
-
\??\c:\ttbhhn.exec:\ttbhhn.exe79⤵PID:2448
-
\??\c:\djjpd.exec:\djjpd.exe80⤵PID:3008
-
\??\c:\3lllflf.exec:\3lllflf.exe81⤵PID:1916
-
\??\c:\rffrllf.exec:\rffrllf.exe82⤵PID:2140
-
\??\c:\hnhnbn.exec:\hnhnbn.exe83⤵PID:792
-
\??\c:\pvpdp.exec:\pvpdp.exe84⤵PID:2856
-
\??\c:\lrxxflr.exec:\lrxxflr.exe85⤵PID:2496
-
\??\c:\lfffxfr.exec:\lfffxfr.exe86⤵PID:2716
-
\??\c:\7tnthh.exec:\7tnthh.exe87⤵PID:2184
-
\??\c:\jvdpd.exec:\jvdpd.exe88⤵PID:2608
-
\??\c:\xrrflff.exec:\xrrflff.exe89⤵PID:2656
-
\??\c:\bbnntb.exec:\bbnntb.exe90⤵PID:2604
-
\??\c:\pvvpp.exec:\pvvpp.exe91⤵PID:2772
-
\??\c:\pjjjj.exec:\pjjjj.exe92⤵PID:2228
-
\??\c:\xxfxxll.exec:\xxfxxll.exe93⤵PID:772
-
\??\c:\hhtnbn.exec:\hhtnbn.exe94⤵PID:1820
-
\??\c:\ppjpv.exec:\ppjpv.exe95⤵PID:684
-
\??\c:\rrlrflf.exec:\rrlrflf.exe96⤵PID:2776
-
\??\c:\bhbhth.exec:\bhbhth.exe97⤵PID:1516
-
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:668
-
\??\c:\dppvp.exec:\dppvp.exe99⤵PID:1484
-
\??\c:\lrflxfx.exec:\lrflxfx.exe100⤵PID:2936
-
\??\c:\nnhnbt.exec:\nnhnbt.exe101⤵PID:1472
-
\??\c:\hnbhtn.exec:\hnbhtn.exe102⤵PID:2280
-
\??\c:\pvjpv.exec:\pvjpv.exe103⤵PID:2808
-
\??\c:\xxflrfx.exec:\xxflrfx.exe104⤵PID:2376
-
\??\c:\btbbbb.exec:\btbbbb.exe105⤵PID:2968
-
\??\c:\vdjjv.exec:\vdjjv.exe106⤵PID:2988
-
\??\c:\xlffxfr.exec:\xlffxfr.exe107⤵PID:1204
-
\??\c:\bbnthn.exec:\bbnthn.exe108⤵PID:292
-
\??\c:\7jjpp.exec:\7jjpp.exe109⤵PID:1524
-
\??\c:\dpjpj.exec:\dpjpj.exe110⤵PID:1824
-
\??\c:\lrllfrf.exec:\lrllfrf.exe111⤵PID:1784
-
\??\c:\hhbnht.exec:\hhbnht.exe112⤵PID:1488
-
\??\c:\pvvdj.exec:\pvvdj.exe113⤵PID:1692
-
\??\c:\9dpdd.exec:\9dpdd.exe114⤵PID:1952
-
\??\c:\lxxfrxf.exec:\lxxfrxf.exe115⤵PID:1912
-
\??\c:\hnbttn.exec:\hnbttn.exe116⤵PID:3052
-
\??\c:\pdpjd.exec:\pdpjd.exe117⤵PID:1900
-
\??\c:\9xlffxf.exec:\9xlffxf.exe118⤵PID:1088
-
\??\c:\rrllxfl.exec:\rrllxfl.exe119⤵PID:2408
-
\??\c:\hbhhbt.exec:\hbhhbt.exe120⤵PID:2400
-
\??\c:\jjjvd.exec:\jjjvd.exe121⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-