Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe
Resource
win7-20241010-en
General
-
Target
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe
-
Size
454KB
-
MD5
43c1c7cb96a737ca40e8b50b17804728
-
SHA1
f84413491b80f000495ed48944238c0eaabd9aff
-
SHA256
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0
-
SHA512
04e4c15dc5fcad53b218b1561e2e261bd05f32a48baab99462a9b6263b938b096b693408c162d012b384c8c7b12bf5571f9a191d68e4cf477b96c1c3b56c7451
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2528-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-144-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2372-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1392-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 htjfbf.exe 2916 fjhbd.exe 3012 vbrll.exe 2032 lrhbjlr.exe 2964 ffdxl.exe 2816 ffjnp.exe 2784 xnlhbrr.exe 2552 pfxnhr.exe 2472 dfxpf.exe 932 ljtfhrv.exe 2240 vdjxb.exe 2136 hvrflrt.exe 2832 tltbfr.exe 3052 tdxff.exe 2448 jtbffh.exe 760 nfdhd.exe 2372 hrrrd.exe 588 dxvrtpt.exe 2404 xlfjh.exe 2632 ppxttj.exe 1820 vjxjrx.exe 2692 httpl.exe 1624 lplxr.exe 2460 tvxdvvx.exe 592 tfnrp.exe 2484 ttdrlp.exe 1936 nfbpppx.exe 1552 dffnjbv.exe 524 pfnxlh.exe 1168 ppfhbdf.exe 1032 tvfdnh.exe 2636 nnjdn.exe 1824 tndrxtt.exe 2396 bdhrvv.exe 2924 fpblxd.exe 1612 rdrpjr.exe 2996 pjntr.exe 568 pphxdt.exe 3060 ddbtpf.exe 2964 dpvxdvt.exe 2772 tfxhd.exe 2848 txhfptl.exe 2192 bjhddx.exe 2452 pdvffdt.exe 1720 ptbxxp.exe 1992 pnrtnpv.exe 1392 pbthlb.exe 1984 lhtjp.exe 1276 vrjfl.exe 2872 xdfhnxx.exe 3024 npjlj.exe 2328 tprdndd.exe 2448 rhdjbv.exe 1880 ddbtt.exe 580 rpdhnnt.exe 2400 vprvptf.exe 1204 plxxtpr.exe 2236 pvpjbdv.exe 960 jxxxv.exe 904 rnbjjr.exe 2444 pbhxdl.exe 2004 hxrphvf.exe 1924 jbbhr.exe 2204 ldxpxp.exe -
resource yara_rule behavioral1/memory/2528-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-120-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2136-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-860-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrhnhtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvjtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpfrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njptlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbnhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxvrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxvnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdtjff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bltvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrhfttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfhrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxpxdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbltfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbflhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhrpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphxdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjlxhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjthxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdnrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvhdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftjrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlnlh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3048 2528 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 30 PID 2528 wrote to memory of 3048 2528 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 30 PID 2528 wrote to memory of 3048 2528 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 30 PID 2528 wrote to memory of 3048 2528 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 30 PID 3048 wrote to memory of 2916 3048 htjfbf.exe 31 PID 3048 wrote to memory of 2916 3048 htjfbf.exe 31 PID 3048 wrote to memory of 2916 3048 htjfbf.exe 31 PID 3048 wrote to memory of 2916 3048 htjfbf.exe 31 PID 2916 wrote to memory of 3012 2916 fjhbd.exe 32 PID 2916 wrote to memory of 3012 2916 fjhbd.exe 32 PID 2916 wrote to memory of 3012 2916 fjhbd.exe 32 PID 2916 wrote to memory of 3012 2916 fjhbd.exe 32 PID 3012 wrote to memory of 2032 3012 vbrll.exe 33 PID 3012 wrote to memory of 2032 3012 vbrll.exe 33 PID 3012 wrote to memory of 2032 3012 vbrll.exe 33 PID 3012 wrote to memory of 2032 3012 vbrll.exe 33 PID 2032 wrote to memory of 2964 2032 lrhbjlr.exe 34 PID 2032 wrote to memory of 2964 2032 lrhbjlr.exe 34 PID 2032 wrote to memory of 2964 2032 lrhbjlr.exe 34 PID 2032 wrote to memory of 2964 2032 lrhbjlr.exe 34 PID 2964 wrote to memory of 2816 2964 ffdxl.exe 35 PID 2964 wrote to memory of 2816 2964 ffdxl.exe 35 PID 2964 wrote to memory of 2816 2964 ffdxl.exe 35 PID 2964 wrote to memory of 2816 2964 ffdxl.exe 35 PID 2816 wrote to memory of 2784 2816 ffjnp.exe 36 PID 2816 wrote to memory of 2784 2816 ffjnp.exe 36 PID 2816 wrote to memory of 2784 2816 ffjnp.exe 36 PID 2816 wrote to memory of 2784 2816 ffjnp.exe 36 PID 2784 wrote to memory of 2552 2784 xnlhbrr.exe 37 PID 2784 wrote to memory of 2552 2784 xnlhbrr.exe 37 PID 2784 wrote to memory of 2552 2784 xnlhbrr.exe 37 PID 2784 wrote to memory of 2552 2784 xnlhbrr.exe 37 PID 2552 wrote to memory of 2472 2552 pfxnhr.exe 38 PID 2552 wrote to memory of 2472 2552 pfxnhr.exe 38 PID 2552 wrote to memory of 2472 2552 pfxnhr.exe 38 PID 2552 wrote to memory of 2472 2552 pfxnhr.exe 38 PID 2472 wrote to memory of 932 2472 dfxpf.exe 39 PID 2472 wrote to memory of 932 2472 dfxpf.exe 39 PID 2472 wrote to memory of 932 2472 dfxpf.exe 39 PID 2472 wrote to memory of 932 2472 dfxpf.exe 39 PID 932 wrote to memory of 2240 932 ljtfhrv.exe 40 PID 932 wrote to memory of 2240 932 ljtfhrv.exe 40 PID 932 wrote to memory of 2240 932 ljtfhrv.exe 40 PID 932 wrote to memory of 2240 932 ljtfhrv.exe 40 PID 2240 wrote to memory of 2136 2240 vdjxb.exe 41 PID 2240 wrote to memory of 2136 2240 vdjxb.exe 41 PID 2240 wrote to memory of 2136 2240 vdjxb.exe 41 PID 2240 wrote to memory of 2136 2240 vdjxb.exe 41 PID 2136 wrote to memory of 2832 2136 hvrflrt.exe 42 PID 2136 wrote to memory of 2832 2136 hvrflrt.exe 42 PID 2136 wrote to memory of 2832 2136 hvrflrt.exe 42 PID 2136 wrote to memory of 2832 2136 hvrflrt.exe 42 PID 2832 wrote to memory of 3052 2832 tltbfr.exe 43 PID 2832 wrote to memory of 3052 2832 tltbfr.exe 43 PID 2832 wrote to memory of 3052 2832 tltbfr.exe 43 PID 2832 wrote to memory of 3052 2832 tltbfr.exe 43 PID 3052 wrote to memory of 2448 3052 tdxff.exe 44 PID 3052 wrote to memory of 2448 3052 tdxff.exe 44 PID 3052 wrote to memory of 2448 3052 tdxff.exe 44 PID 3052 wrote to memory of 2448 3052 tdxff.exe 44 PID 2448 wrote to memory of 760 2448 jtbffh.exe 45 PID 2448 wrote to memory of 760 2448 jtbffh.exe 45 PID 2448 wrote to memory of 760 2448 jtbffh.exe 45 PID 2448 wrote to memory of 760 2448 jtbffh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe"C:\Users\Admin\AppData\Local\Temp\6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\htjfbf.exec:\htjfbf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\fjhbd.exec:\fjhbd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vbrll.exec:\vbrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lrhbjlr.exec:\lrhbjlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\ffdxl.exec:\ffdxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ffjnp.exec:\ffjnp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xnlhbrr.exec:\xnlhbrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pfxnhr.exec:\pfxnhr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dfxpf.exec:\dfxpf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ljtfhrv.exec:\ljtfhrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\vdjxb.exec:\vdjxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hvrflrt.exec:\hvrflrt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tltbfr.exec:\tltbfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\tdxff.exec:\tdxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jtbffh.exec:\jtbffh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nfdhd.exec:\nfdhd.exe17⤵
- Executes dropped EXE
PID:760 -
\??\c:\hrrrd.exec:\hrrrd.exe18⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dxvrtpt.exec:\dxvrtpt.exe19⤵
- Executes dropped EXE
PID:588 -
\??\c:\xlfjh.exec:\xlfjh.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ppxttj.exec:\ppxttj.exe21⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vjxjrx.exec:\vjxjrx.exe22⤵
- Executes dropped EXE
PID:1820 -
\??\c:\httpl.exec:\httpl.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lplxr.exec:\lplxr.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tvxdvvx.exec:\tvxdvvx.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tfnrp.exec:\tfnrp.exe26⤵
- Executes dropped EXE
PID:592 -
\??\c:\ttdrlp.exec:\ttdrlp.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nfbpppx.exec:\nfbpppx.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dffnjbv.exec:\dffnjbv.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pfnxlh.exec:\pfnxlh.exe30⤵
- Executes dropped EXE
PID:524 -
\??\c:\ppfhbdf.exec:\ppfhbdf.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tvfdnh.exec:\tvfdnh.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nnjdn.exec:\nnjdn.exe33⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tndrxtt.exec:\tndrxtt.exe34⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bdhrvv.exec:\bdhrvv.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fpblxd.exec:\fpblxd.exe36⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rdrpjr.exec:\rdrpjr.exe37⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjntr.exec:\pjntr.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\pphxdt.exec:\pphxdt.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:568 -
\??\c:\ddbtpf.exec:\ddbtpf.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dpvxdvt.exec:\dpvxdvt.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tfxhd.exec:\tfxhd.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\txhfptl.exec:\txhfptl.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bjhddx.exec:\bjhddx.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdvffdt.exec:\pdvffdt.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ptbxxp.exec:\ptbxxp.exe46⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pnrtnpv.exec:\pnrtnpv.exe47⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pbthlb.exec:\pbthlb.exe48⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lhtjp.exec:\lhtjp.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vrjfl.exec:\vrjfl.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xdfhnxx.exec:\xdfhnxx.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\npjlj.exec:\npjlj.exe52⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tprdndd.exec:\tprdndd.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rhdjbv.exec:\rhdjbv.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddbtt.exec:\ddbtt.exe55⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rpdhnnt.exec:\rpdhnnt.exe56⤵
- Executes dropped EXE
PID:580 -
\??\c:\vprvptf.exec:\vprvptf.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\plxxtpr.exec:\plxxtpr.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pvpjbdv.exec:\pvpjbdv.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jxxxv.exec:\jxxxv.exe60⤵
- Executes dropped EXE
PID:960 -
\??\c:\rnbjjr.exec:\rnbjjr.exe61⤵
- Executes dropped EXE
PID:904 -
\??\c:\pbhxdl.exec:\pbhxdl.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hxrphvf.exec:\hxrphvf.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jbbhr.exec:\jbbhr.exe64⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ldxpxp.exec:\ldxpxp.exe65⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rbntphn.exec:\rbntphn.exe66⤵PID:2460
-
\??\c:\jrhnhtr.exec:\jrhnhtr.exe67⤵
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\bvrbf.exec:\bvrbf.exe68⤵PID:2640
-
\??\c:\pnvdd.exec:\pnvdd.exe69⤵PID:2516
-
\??\c:\vlrhvvr.exec:\vlrhvvr.exe70⤵PID:1060
-
\??\c:\vpjpvr.exec:\vpjpvr.exe71⤵PID:1300
-
\??\c:\xpdlvh.exec:\xpdlvh.exe72⤵PID:1076
-
\??\c:\lbblb.exec:\lbblb.exe73⤵PID:1680
-
\??\c:\vhfdhln.exec:\vhfdhln.exe74⤵PID:1032
-
\??\c:\hfxhjx.exec:\hfxhjx.exe75⤵PID:2388
-
\??\c:\rltvhhb.exec:\rltvhhb.exe76⤵PID:2968
-
\??\c:\vdpfjx.exec:\vdpfjx.exe77⤵PID:2916
-
\??\c:\tbtbd.exec:\tbtbd.exe78⤵PID:2396
-
\??\c:\blnpdxj.exec:\blnpdxj.exe79⤵PID:1616
-
\??\c:\hbnxld.exec:\hbnxld.exe80⤵PID:1612
-
\??\c:\hnxtx.exec:\hnxtx.exe81⤵PID:2124
-
\??\c:\jjvbht.exec:\jjvbht.exe82⤵PID:568
-
\??\c:\jvbhbn.exec:\jvbhbn.exe83⤵PID:3060
-
\??\c:\vnvrtln.exec:\vnvrtln.exe84⤵PID:2812
-
\??\c:\lhrvvp.exec:\lhrvvp.exe85⤵PID:2828
-
\??\c:\plvjfnh.exec:\plvjfnh.exe86⤵PID:2940
-
\??\c:\ldfdlp.exec:\ldfdlp.exe87⤵PID:2192
-
\??\c:\llnpbr.exec:\llnpbr.exe88⤵PID:2868
-
\??\c:\xljhllx.exec:\xljhllx.exe89⤵PID:1528
-
\??\c:\hvnfv.exec:\hvnfv.exe90⤵PID:320
-
\??\c:\xplhjt.exec:\xplhjt.exe91⤵PID:2332
-
\??\c:\rrvpl.exec:\rrvpl.exe92⤵PID:2960
-
\??\c:\pxrrbrx.exec:\pxrrbrx.exe93⤵PID:3004
-
\??\c:\fnxnb.exec:\fnxnb.exe94⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\llnnt.exec:\llnnt.exe95⤵PID:2300
-
\??\c:\thpjd.exec:\thpjd.exe96⤵PID:2348
-
\??\c:\xfhptp.exec:\xfhptp.exe97⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\prnpnhj.exec:\prnpnhj.exe98⤵PID:1880
-
\??\c:\tnrfld.exec:\tnrfld.exe99⤵PID:2504
-
\??\c:\pvnfhl.exec:\pvnfhl.exe100⤵PID:2428
-
\??\c:\pxtxvl.exec:\pxtxvl.exe101⤵PID:2256
-
\??\c:\bndtfrd.exec:\bndtfrd.exe102⤵PID:2312
-
\??\c:\tjfff.exec:\tjfff.exe103⤵PID:2384
-
\??\c:\nfjjd.exec:\nfjjd.exe104⤵PID:960
-
\??\c:\ddxfrj.exec:\ddxfrj.exe105⤵PID:2108
-
\??\c:\vrnfnfl.exec:\vrnfnfl.exe106⤵PID:1208
-
\??\c:\bfhjxvr.exec:\bfhjxvr.exe107⤵PID:1624
-
\??\c:\dbldl.exec:\dbldl.exe108⤵PID:2572
-
\??\c:\btdntnl.exec:\btdntnl.exe109⤵PID:1512
-
\??\c:\nxvff.exec:\nxvff.exe110⤵PID:1812
-
\??\c:\rvtlvpn.exec:\rvtlvpn.exe111⤵PID:668
-
\??\c:\ftrvb.exec:\ftrvb.exe112⤵PID:2736
-
\??\c:\bbnpr.exec:\bbnpr.exe113⤵PID:1324
-
\??\c:\fvhttfd.exec:\fvhttfd.exe114⤵PID:2172
-
\??\c:\hxtnbxf.exec:\hxtnbxf.exe115⤵PID:2764
-
\??\c:\pxvvt.exec:\pxvvt.exe116⤵PID:1580
-
\??\c:\jrfxhxh.exec:\jrfxhxh.exe117⤵PID:1680
-
\??\c:\jhblhvh.exec:\jhblhvh.exe118⤵PID:1032
-
\??\c:\fhpvd.exec:\fhpvd.exe119⤵PID:2388
-
\??\c:\pnhxbxp.exec:\pnhxbxp.exe120⤵PID:2968
-
\??\c:\dbdxjhd.exec:\dbdxjhd.exe121⤵PID:1476
-
\??\c:\brjth.exec:\brjth.exe122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-