Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 13:33
Behavioral task
behavioral1
Sample
fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe
-
Size
59KB
-
MD5
fbbb6de8922294c688c33dfc06ce1f56
-
SHA1
fb5d9ec633cb741e2df500d034f772fd4dfba889
-
SHA256
e389fc7702ef3bae80700b07f7491d8fd3b53ae37fef8b40101f3160d423b607
-
SHA512
44059f2028ac9129ce32e6da89a07cbe1010b50816570d1ecd1f56591aee2f44149307b8f817dc925ca8e07aa630e1dd3c7a65274d1672404c196098a69e7f3b
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQld+9FmoX:khOmTsF93UYfwC6GIoutpYcvld+9FX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2032-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-686-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-941-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4556 fxxrrxx.exe 1116 xrllffx.exe 436 7nhhbb.exe 4840 ppvdj.exe 3688 rllffff.exe 3164 fxfxxxf.exe 1608 tnttbb.exe 1660 dddvj.exe 2324 rlrrlfx.exe 4316 nntbbh.exe 3500 1pvpv.exe 4900 jpvpp.exe 4068 rxflfxl.exe 4824 lffxllr.exe 3844 vdjdd.exe 3316 rrxxlfr.exe 2932 lrllffx.exe 4424 3btnnb.exe 4996 1bnnnt.exe 4972 lrlfrfx.exe 4624 bntbbb.exe 1056 hbhhbb.exe 4884 vpppd.exe 316 dvddd.exe 4920 fxxrllf.exe 5116 hbbbtn.exe 5108 tnbbbb.exe 2428 9pvpj.exe 452 fxfxrrr.exe 5076 bhhhnn.exe 968 hhnhtn.exe 2648 pppdj.exe 3544 xrxxllf.exe 4812 7tthth.exe 3140 tntnnh.exe 3556 ppppp.exe 3588 7frlrxr.exe 4244 flxllfl.exe 464 nthttn.exe 4864 pddvv.exe 3524 jvpdp.exe 4484 7lxxxrx.exe 1332 rxffxxr.exe 2352 nbbtnn.exe 5000 hhbtbb.exe 4376 dvvjd.exe 5008 lrxxrrl.exe 3672 rlrllff.exe 3320 hbtbbh.exe 4152 bnnhbb.exe 1096 dpdvp.exe 2636 frxrllf.exe 4840 lffxrlr.exe 3460 5hhhbb.exe 2456 hbhthb.exe 5016 vjjvp.exe 1608 rfxrfxx.exe 2980 fxrlxxl.exe 1772 1thnbb.exe 3456 nbhhbb.exe 4316 jdppv.exe 3492 jdjdp.exe 3000 rfffxxr.exe 4076 fffxrfx.exe -
resource yara_rule behavioral2/memory/2032-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b9a-3.dat upx behavioral2/memory/2032-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b9d-9.dat upx behavioral2/memory/4556-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1116-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bae-14.dat upx behavioral2/memory/1116-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/436-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bb7-23.dat upx behavioral2/memory/436-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4840-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbc-30.dat upx behavioral2/memory/4840-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbd-35.dat upx behavioral2/memory/3688-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbe-41.dat upx behavioral2/memory/3164-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bc2-47.dat upx behavioral2/memory/1608-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1660-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc4-53.dat upx behavioral2/memory/2324-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc7-59.dat upx behavioral2/files/0x0008000000023bc8-65.dat upx behavioral2/memory/4316-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bc9-71.dat upx behavioral2/memory/3500-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bca-79.dat upx behavioral2/memory/4900-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4068-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bf9-86.dat upx behavioral2/files/0x0008000000023bfa-89.dat upx behavioral2/memory/4824-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bfb-94.dat upx behavioral2/memory/3844-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3316-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bfc-102.dat upx behavioral2/memory/2932-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bfe-108.dat upx behavioral2/files/0x0008000000023c03-113.dat upx behavioral2/files/0x0008000000023c04-118.dat upx behavioral2/files/0x0008000000023c05-122.dat upx behavioral2/files/0x0008000000023c17-127.dat upx behavioral2/memory/4624-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1d-133.dat upx behavioral2/memory/1056-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1e-139.dat upx behavioral2/memory/4884-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1f-145.dat upx behavioral2/files/0x0008000000023c20-150.dat upx behavioral2/memory/4920-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c21-157.dat upx behavioral2/files/0x0008000000023c22-162.dat upx behavioral2/memory/5108-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023c37-168.dat upx behavioral2/files/0x000c000000023b9e-173.dat upx behavioral2/files/0x0016000000023c38-178.dat upx behavioral2/memory/5076-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c3e-185.dat upx behavioral2/memory/968-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3544-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4812-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 4556 2032 fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe 82 PID 2032 wrote to memory of 4556 2032 fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe 82 PID 2032 wrote to memory of 4556 2032 fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe 82 PID 4556 wrote to memory of 1116 4556 fxxrrxx.exe 83 PID 4556 wrote to memory of 1116 4556 fxxrrxx.exe 83 PID 4556 wrote to memory of 1116 4556 fxxrrxx.exe 83 PID 1116 wrote to memory of 436 1116 xrllffx.exe 84 PID 1116 wrote to memory of 436 1116 xrllffx.exe 84 PID 1116 wrote to memory of 436 1116 xrllffx.exe 84 PID 436 wrote to memory of 4840 436 7nhhbb.exe 85 PID 436 wrote to memory of 4840 436 7nhhbb.exe 85 PID 436 wrote to memory of 4840 436 7nhhbb.exe 85 PID 4840 wrote to memory of 3688 4840 ppvdj.exe 86 PID 4840 wrote to memory of 3688 4840 ppvdj.exe 86 PID 4840 wrote to memory of 3688 4840 ppvdj.exe 86 PID 3688 wrote to memory of 3164 3688 rllffff.exe 87 PID 3688 wrote to memory of 3164 3688 rllffff.exe 87 PID 3688 wrote to memory of 3164 3688 rllffff.exe 87 PID 3164 wrote to memory of 1608 3164 fxfxxxf.exe 88 PID 3164 wrote to memory of 1608 3164 fxfxxxf.exe 88 PID 3164 wrote to memory of 1608 3164 fxfxxxf.exe 88 PID 1608 wrote to memory of 1660 1608 tnttbb.exe 89 PID 1608 wrote to memory of 1660 1608 tnttbb.exe 89 PID 1608 wrote to memory of 1660 1608 tnttbb.exe 89 PID 1660 wrote to memory of 2324 1660 dddvj.exe 90 PID 1660 wrote to memory of 2324 1660 dddvj.exe 90 PID 1660 wrote to memory of 2324 1660 dddvj.exe 90 PID 2324 wrote to memory of 4316 2324 rlrrlfx.exe 91 PID 2324 wrote to memory of 4316 2324 rlrrlfx.exe 91 PID 2324 wrote to memory of 4316 2324 rlrrlfx.exe 91 PID 4316 wrote to memory of 3500 4316 nntbbh.exe 92 PID 4316 wrote to memory of 3500 4316 nntbbh.exe 92 PID 4316 wrote to memory of 3500 4316 nntbbh.exe 92 PID 3500 wrote to memory of 4900 3500 1pvpv.exe 93 PID 3500 wrote to memory of 4900 3500 1pvpv.exe 93 PID 3500 wrote to memory of 4900 3500 1pvpv.exe 93 PID 4900 wrote to memory of 4068 4900 jpvpp.exe 94 PID 4900 wrote to memory of 4068 4900 jpvpp.exe 94 PID 4900 wrote to memory of 4068 4900 jpvpp.exe 94 PID 4068 wrote to memory of 4824 4068 rxflfxl.exe 95 PID 4068 wrote to memory of 4824 4068 rxflfxl.exe 95 PID 4068 wrote to memory of 4824 4068 rxflfxl.exe 95 PID 4824 wrote to memory of 3844 4824 lffxllr.exe 96 PID 4824 wrote to memory of 3844 4824 lffxllr.exe 96 PID 4824 wrote to memory of 3844 4824 lffxllr.exe 96 PID 3844 wrote to memory of 3316 3844 vdjdd.exe 97 PID 3844 wrote to memory of 3316 3844 vdjdd.exe 97 PID 3844 wrote to memory of 3316 3844 vdjdd.exe 97 PID 3316 wrote to memory of 2932 3316 rrxxlfr.exe 98 PID 3316 wrote to memory of 2932 3316 rrxxlfr.exe 98 PID 3316 wrote to memory of 2932 3316 rrxxlfr.exe 98 PID 2932 wrote to memory of 4424 2932 lrllffx.exe 99 PID 2932 wrote to memory of 4424 2932 lrllffx.exe 99 PID 2932 wrote to memory of 4424 2932 lrllffx.exe 99 PID 4424 wrote to memory of 4996 4424 3btnnb.exe 100 PID 4424 wrote to memory of 4996 4424 3btnnb.exe 100 PID 4424 wrote to memory of 4996 4424 3btnnb.exe 100 PID 4996 wrote to memory of 4972 4996 1bnnnt.exe 101 PID 4996 wrote to memory of 4972 4996 1bnnnt.exe 101 PID 4996 wrote to memory of 4972 4996 1bnnnt.exe 101 PID 4972 wrote to memory of 4624 4972 lrlfrfx.exe 102 PID 4972 wrote to memory of 4624 4972 lrlfrfx.exe 102 PID 4972 wrote to memory of 4624 4972 lrlfrfx.exe 102 PID 4624 wrote to memory of 1056 4624 bntbbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbbb6de8922294c688c33dfc06ce1f56_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\xrllffx.exec:\xrllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\7nhhbb.exec:\7nhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\ppvdj.exec:\ppvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\rllffff.exec:\rllffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\dddvj.exec:\dddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\nntbbh.exec:\nntbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\1pvpv.exec:\1pvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jpvpp.exec:\jpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rxflfxl.exec:\rxflfxl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\lffxllr.exec:\lffxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\vdjdd.exec:\vdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\rrxxlfr.exec:\rrxxlfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\lrllffx.exec:\lrllffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3btnnb.exec:\3btnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\1bnnnt.exec:\1bnnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\lrlfrfx.exec:\lrlfrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bntbbb.exec:\bntbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\hbhhbb.exec:\hbhhbb.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vpppd.exec:\vpppd.exe24⤵
- Executes dropped EXE
PID:4884 -
\??\c:\dvddd.exec:\dvddd.exe25⤵
- Executes dropped EXE
PID:316 -
\??\c:\fxxrllf.exec:\fxxrllf.exe26⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hbbbtn.exec:\hbbbtn.exe27⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnbbbb.exec:\tnbbbb.exe28⤵
- Executes dropped EXE
PID:5108 -
\??\c:\9pvpj.exec:\9pvpj.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe30⤵
- Executes dropped EXE
PID:452 -
\??\c:\bhhhnn.exec:\bhhhnn.exe31⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hhnhtn.exec:\hhnhtn.exe32⤵
- Executes dropped EXE
PID:968 -
\??\c:\pppdj.exec:\pppdj.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrxxllf.exec:\xrxxllf.exe34⤵
- Executes dropped EXE
PID:3544 -
\??\c:\7tthth.exec:\7tthth.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\tntnnh.exec:\tntnnh.exe36⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ppppp.exec:\ppppp.exe37⤵
- Executes dropped EXE
PID:3556 -
\??\c:\7frlrxr.exec:\7frlrxr.exe38⤵
- Executes dropped EXE
PID:3588 -
\??\c:\flxllfl.exec:\flxllfl.exe39⤵
- Executes dropped EXE
PID:4244 -
\??\c:\nthttn.exec:\nthttn.exe40⤵
- Executes dropped EXE
PID:464 -
\??\c:\pddvv.exec:\pddvv.exe41⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jvpdp.exec:\jvpdp.exe42⤵
- Executes dropped EXE
PID:3524 -
\??\c:\7lxxxrx.exec:\7lxxxrx.exe43⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rxffxxr.exec:\rxffxxr.exe44⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nbbtnn.exec:\nbbtnn.exe45⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhbtbb.exec:\hhbtbb.exe46⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dvvjd.exec:\dvvjd.exe47⤵
- Executes dropped EXE
PID:4376 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe48⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rlrllff.exec:\rlrllff.exe49⤵
- Executes dropped EXE
PID:3672 -
\??\c:\hbtbbh.exec:\hbtbbh.exe50⤵
- Executes dropped EXE
PID:3320 -
\??\c:\bnnhbb.exec:\bnnhbb.exe51⤵
- Executes dropped EXE
PID:4152 -
\??\c:\dpdvp.exec:\dpdvp.exe52⤵
- Executes dropped EXE
PID:1096 -
\??\c:\frxrllf.exec:\frxrllf.exe53⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lffxrlr.exec:\lffxrlr.exe54⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5hhhbb.exec:\5hhhbb.exe55⤵
- Executes dropped EXE
PID:3460 -
\??\c:\hbhthb.exec:\hbhthb.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vjjvp.exec:\vjjvp.exe57⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rfxrfxx.exec:\rfxrfxx.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxrlxxl.exec:\fxrlxxl.exe59⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1thnbb.exec:\1thnbb.exe60⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbhhbb.exec:\nbhhbb.exe61⤵
- Executes dropped EXE
PID:3456 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:4316 -
\??\c:\jdjdp.exec:\jdjdp.exe63⤵
- Executes dropped EXE
PID:3492 -
\??\c:\rfffxxr.exec:\rfffxxr.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fffxrfx.exec:\fffxrfx.exe65⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5nnthh.exec:\5nnthh.exe66⤵PID:2252
-
\??\c:\htbtnh.exec:\htbtnh.exe67⤵PID:2196
-
\??\c:\jdvvp.exec:\jdvvp.exe68⤵PID:2552
-
\??\c:\3rxlxrr.exec:\3rxlxrr.exe69⤵PID:3844
-
\??\c:\7lxrfxl.exec:\7lxrfxl.exe70⤵PID:4460
-
\??\c:\5hhhbt.exec:\5hhhbt.exe71⤵PID:1988
-
\??\c:\9nnhbn.exec:\9nnhbn.exe72⤵PID:972
-
\??\c:\djjvj.exec:\djjvj.exe73⤵PID:2972
-
\??\c:\xrrlxfr.exec:\xrrlxfr.exe74⤵PID:4188
-
\??\c:\1lllfff.exec:\1lllfff.exe75⤵PID:4196
-
\??\c:\nhbbnh.exec:\nhbbnh.exe76⤵PID:4124
-
\??\c:\1tbntn.exec:\1tbntn.exe77⤵PID:1472
-
\??\c:\9jpdj.exec:\9jpdj.exe78⤵PID:4732
-
\??\c:\dppvp.exec:\dppvp.exe79⤵PID:2620
-
\??\c:\3ffxlll.exec:\3ffxlll.exe80⤵PID:4980
-
\??\c:\jjvpv.exec:\jjvpv.exe81⤵PID:1648
-
\??\c:\fllfxrr.exec:\fllfxrr.exe82⤵PID:2924
-
\??\c:\tnbtnh.exec:\tnbtnh.exe83⤵PID:3432
-
\??\c:\bbnhbb.exec:\bbnhbb.exe84⤵PID:3740
-
\??\c:\vvdpj.exec:\vvdpj.exe85⤵PID:2632
-
\??\c:\1ppjd.exec:\1ppjd.exe86⤵PID:3332
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe87⤵PID:1044
-
\??\c:\fxxxfff.exec:\fxxxfff.exe88⤵PID:452
-
\??\c:\tttnnb.exec:\tttnnb.exe89⤵PID:5044
-
\??\c:\nnbbhn.exec:\nnbbhn.exe90⤵PID:3484
-
\??\c:\ddvvv.exec:\ddvvv.exe91⤵PID:4560
-
\??\c:\1djdd.exec:\1djdd.exe92⤵PID:1228
-
\??\c:\frlxlfx.exec:\frlxlfx.exe93⤵PID:2708
-
\??\c:\btnhbt.exec:\btnhbt.exe94⤵PID:3272
-
\??\c:\bntnhh.exec:\bntnhh.exe95⤵PID:3608
-
\??\c:\jjdvp.exec:\jjdvp.exe96⤵PID:4828
-
\??\c:\vjpdv.exec:\vjpdv.exe97⤵PID:4728
-
\??\c:\3xxllff.exec:\3xxllff.exe98⤵PID:1540
-
\??\c:\7tbnbt.exec:\7tbnbt.exe99⤵PID:1632
-
\??\c:\hhnnhh.exec:\hhnnhh.exe100⤵PID:2312
-
\??\c:\1pdvv.exec:\1pdvv.exe101⤵PID:3524
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:2568
-
\??\c:\xxfxxxl.exec:\xxfxxxl.exe103⤵PID:3752
-
\??\c:\hnnnhh.exec:\hnnnhh.exe104⤵PID:4400
-
\??\c:\btbtnn.exec:\btbtnn.exe105⤵PID:4364
-
\??\c:\vpjdv.exec:\vpjdv.exe106⤵PID:1588
-
\??\c:\lllfxxx.exec:\lllfxxx.exe107⤵PID:4404
-
\??\c:\7xxrlll.exec:\7xxrlll.exe108⤵PID:4556
-
\??\c:\bbhhhb.exec:\bbhhhb.exe109⤵PID:2836
-
\??\c:\jddjd.exec:\jddjd.exe110⤵PID:1468
-
\??\c:\dvvpd.exec:\dvvpd.exe111⤵PID:3276
-
\??\c:\llrfrfl.exec:\llrfrfl.exe112⤵PID:2660
-
\??\c:\xrxrxff.exec:\xrxrxff.exe113⤵PID:60
-
\??\c:\nbthnh.exec:\nbthnh.exe114⤵PID:4760
-
\??\c:\jdvjv.exec:\jdvjv.exe115⤵PID:4616
-
\??\c:\ppjpv.exec:\ppjpv.exe116⤵PID:4744
-
\??\c:\xxflrff.exec:\xxflrff.exe117⤵PID:1508
-
\??\c:\lrrrllx.exec:\lrrrllx.exe118⤵PID:2980
-
\??\c:\5bthtb.exec:\5bthtb.exe119⤵PID:3744
-
\??\c:\bnnhhh.exec:\bnnhhh.exe120⤵PID:2508
-
\??\c:\jvpjd.exec:\jvpjd.exe121⤵PID:4896
-
\??\c:\xllxlxr.exec:\xllxlxr.exe122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-