Analysis
- max time kernel
64s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 22:31
Behavioral task
behavioral1
Sample
jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
- Size 9KB
- Sample260919-2fmlcatz5j
- SHA256 022dba6141f7a6af45717743048b36cc5a148ca0494536e79fe0a3789c9efc88
- MD5 2d804bec8b656e0bfa4ba06885a65f31
- SHA1 31599ef353965cff0cd3dbd36dd416b3b73eef47
- SHA512 152fe320d268d77368af7efb07720ce678b2b65c6f2d1ecb9f7c8cb84854a5c2f769516ec800f0ee8c993d0e292c6a7bbb8af500b94b5d56a6d717d579c5fed2
- SSDEEP 192:5VSCS71IPrpeFa0XAxAWi0GEqhdHdfnXZZ9Tw5:7iuo3XUAWi0GEqh5BJZ9e
- TLSH T122128F83C0763BD5E08A0478C4D3B5D43BFE5576D6AACB53C3923615385EB72258CE12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 692 foqrdkh.exe 4632 skeaayld.exe 1652 igxurrn.exe 1236 twvurwl.exe 3116 gtfzxajx.exe 1284 xpisxvpg.exe 4156 lkpmxhib.exe 4616 vpltp.exe 4984 qdjrfm.exe 4576 ejclwdj.exe 4992 ptvqkaxr.exe 4388 vnuvbp.exe 2632 iifzbzl.exe 1316 mvgaxadb.exe 3576 ikhzfx.exe 4636 fncbwuf.exe 3324 xlbtu.exe 1224 kjhjabq.exe 3316 bjbjbvd.exe 960 tfpfbb.exe 3820 culcdot.exe 5060 pdnhtddx.exe 4764 tnevvbek.exe 4592 llqgex.exe 4168 yxivif.exe 748 katjzh.exe 2276 vwwayks.exe 3716 dppbkug.exe 2304 wmxaz.exe 4052 dfvhrv.exe 3148 fvmuo.exe 2008 nwtaiug.exe 4332 rvywq.exe 744 ffohs.exe 4924 sxmka.exe 4700 izxsxo.exe 3956 xdpukyv.exe 4920 wrqandkm.exe 3848 suydr.exe 4852 kfovdqgo.exe 2104 vlllfo.exe 2368 febnajw.exe 1888 waobnhn.exe 3856 twbngztj.exe 1928 vaaws.exe 4076 wsxhzg.exe 420 ocetctym.exe 3280 hmteej.exe 3188 fbamlhw.exe 4584 eepjba.exe 1844 nuseg.exe 5012 kpmllvcs.exe 5020 noczh.exe 556 qkxvelw.exe 2400 xpguvi.exe 4556 snblg.exe 4468 vmrzlz.exe 3308 iztgavi.exe 4488 wmhxezni.exe 2604 ublojb.exe 2528 vllfn.exe 1252 zdeiyqn.exe 4288 cnsfs.exe 1588 waonxzb.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\cfekfrw.exe" jqywxqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ffsffbl.exe" axoymz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\pkilrlu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\oysefpdc.exe" uoecz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\akcghk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\viaepntj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\vdrnm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\yuwfy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\vkbpwbbp.exe" ufyayyw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lajjvaq.exe" dssecgq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\rafijqmx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\vcuexz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\svuwimg.exe" bdpmt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ckjmf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\duahsxb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bdlat.exe" edmedqjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\skoowq.exe" exnxkqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wgvxql.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wmpza.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bthwj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\xqfda.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\twvurwl.exe" igxurrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\zdnoqf.exe" intdqtz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\jlnet.exe" fucan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\edcrodky.exe" svuwimg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\agxcoad.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\pfybtebz.exe" oovsixig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\tgohzb.exe" ucuqj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\vfmcjmo.exe" ylztprzv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uaxni.exe" ejdozir.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bvrpu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\yxivif.exe" llqgex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\qmtymdi.exe" tgsyupd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\rglqpq.exe" jwaihy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dpxxa.exe" azyun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\tdtrvt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\sgzce.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ufemf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\trhxuv.exe" tvntbiu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\rzozlj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dfrodkiz.exe" lfhcxagq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ciepjzzt.exe" cgxbavt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\elmdazve.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\vdfaq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\suydr.exe" wrqandkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\xjasi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\pnimsw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\xvyekgkt.exe" gbosriru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lttoa.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\hdilqii.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\gpnwx.exe" jaooxal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dhuyiez.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ydyro.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\zekdcbuy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lmxfwucg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kfdjb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ugwwsrgu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wbjzgphi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lfskashd.exe" vlnmdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\smivsf.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kzkvrs.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\jeceg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\thosz.exe" ycfbyor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uevboaao.exe" swtyz.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ogsjqmy.exe xuuurv.exe File created C:\Windows\SysWOW64\aehrd.exe wmfxczm.exe File created C:\Windows\SysWOW64\aihynrt.exe Process not Found File opened for modification C:\Windows\SysWOW64\sjmbgaoc.exe Process not Found File opened for modification C:\Windows\SysWOW64\legpj.exe Process not Found File created C:\Windows\SysWOW64\nzvccf.exe Process not Found File opened for modification C:\Windows\SysWOW64\swtyz.exe gowdc.exe File created C:\Windows\SysWOW64\dleyge.exe Process not Found File opened for modification C:\Windows\SysWOW64\bnbni.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffijfp.exe kvhjpm.exe File created C:\Windows\SysWOW64\cyhcez.exe vqnxre.exe File created C:\Windows\SysWOW64\xavmnyf.exe jxehah.exe File opened for modification C:\Windows\SysWOW64\aejnxf.exe Process not Found File opened for modification C:\Windows\SysWOW64\qywjbri.exe rffuossc.exe File created C:\Windows\SysWOW64\lxizcph.exe cxxivl.exe File created C:\Windows\SysWOW64\wndzx.exe kdwrnfj.exe File created C:\Windows\SysWOW64\lnqgdepl.exe Process not Found File opened for modification C:\Windows\SysWOW64\pborwydj.exe Process not Found File created C:\Windows\SysWOW64\swtyz.exe gowdc.exe File created C:\Windows\SysWOW64\fsjjwra.exe nhzxdll.exe File created C:\Windows\SysWOW64\nbklzhh.exe Process not Found File opened for modification C:\Windows\SysWOW64\ptytl.exe Process not Found File created C:\Windows\SysWOW64\fncbwuf.exe ikhzfx.exe File created C:\Windows\SysWOW64\qyzdn.exe iswrsh.exe File created C:\Windows\SysWOW64\xcnccp.exe dppfsgb.exe File created C:\Windows\SysWOW64\vrvgedbv.exe nsvtt.exe File created C:\Windows\SysWOW64\zaqtc.exe iazxj.exe File created C:\Windows\SysWOW64\olnooka.exe yxqlbjj.exe File opened for modification C:\Windows\SysWOW64\udvkhdm.exe ktsel.exe File created C:\Windows\SysWOW64\asxkro.exe itgam.exe File opened for modification C:\Windows\SysWOW64\qndgxkn.exe jnrvz.exe File opened for modification C:\Windows\SysWOW64\ztoucq.exe qthdizhj.exe File created C:\Windows\SysWOW64\awxxkx.exe ysxprpdg.exe File opened for modification C:\Windows\SysWOW64\xcicm.exe Process not Found File created C:\Windows\SysWOW64\gkiywvva.exe Process not Found File opened for modification C:\Windows\SysWOW64\ncuwhu.exe Process not Found File opened for modification C:\Windows\SysWOW64\twbngztj.exe waobnhn.exe File opened for modification C:\Windows\SysWOW64\qyzdn.exe iswrsh.exe File created C:\Windows\SysWOW64\cgyxstpw.exe lqvvgrms.exe File created C:\Windows\SysWOW64\cwzqyyc.exe Process not Found File created C:\Windows\SysWOW64\aljrtbpq.exe rcdlemmg.exe File created C:\Windows\SysWOW64\ijcquwp.exe Process not Found File created C:\Windows\SysWOW64\qvqss.exe Process not Found File created C:\Windows\SysWOW64\drkxvn.exe Process not Found File created C:\Windows\SysWOW64\cjxtxty.exe wyqgmgfe.exe File created C:\Windows\SysWOW64\dekbxsc.exe mpphql.exe File opened for modification C:\Windows\SysWOW64\jaoyim.exe Process not Found File created C:\Windows\SysWOW64\lgpdlmt.exe mrqlww.exe File created C:\Windows\SysWOW64\xzrnmh.exe qcrcnn.exe File created C:\Windows\SysWOW64\ieenpdhw.exe ebkxq.exe File created C:\Windows\SysWOW64\qxcsem.exe Process not Found File opened for modification C:\Windows\SysWOW64\rhswgya.exe mjouoye.exe File opened for modification C:\Windows\SysWOW64\bxxbivgk.exe lpmfpg.exe File created C:\Windows\SysWOW64\ljgrkl.exe fhfoxxk.exe File opened for modification C:\Windows\SysWOW64\ldmzfj.exe gdqraxn.exe File opened for modification C:\Windows\SysWOW64\szyzh.exe quniqweu.exe File created C:\Windows\SysWOW64\cosddh.exe Process not Found File created C:\Windows\SysWOW64\kkadnovo.exe ksxpv.exe File opened for modification C:\Windows\SysWOW64\lpmfpg.exe rbmyxd.exe File created C:\Windows\SysWOW64\lrojqajj.exe Process not Found File opened for modification C:\Windows\SysWOW64\uqlkpon.exe Process not Found File opened for modification C:\Windows\SysWOW64\cdgjeogb.exe xjkazgzb.exe File created C:\Windows\SysWOW64\acjpvo.exe Process not Found File opened for modification C:\Windows\SysWOW64\qebefjw.exe Process not Found -
resource yara_rule behavioral1/memory/3172-0-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/files/0x001200000001e595-3.dat upx behavioral1/memory/1652-14-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/1284-26-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/2632-55-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/1284-69-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/3956-164-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/1252-214-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/4964-221-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/7376-536-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/8856-683-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/10612-947-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/10732-957-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/10780-962-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/11356-1059-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/16460-2082-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/17468-2553-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/18100-2689-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/5100-2727-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/8912-3846-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/19084-4508-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/19800-4587-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/19596-4747-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/5196-8355-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/11212-10434-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/19752-10675-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/20648-11201-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/5788-11192-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/18732-15448-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/21952-15595-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/19268-18749-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral1/memory/11804-19200-0x0000000031000000-0x000000003100A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unzugkbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ovazca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzjnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ismif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huogyr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvqkaxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbjbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iuwwgvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uhgvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gpnwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmdmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvkbxsz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afvor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zpxptl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language okosgcrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srqnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srhquwgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpxxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jwdqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ayyainks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ysxprpdg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mttpwk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tqrbhmxu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffohs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lswjzbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvsdse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wzmoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mgquwn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pzopotj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aegawxg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3172 jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe Token: SeDebugPrivilege 692 foqrdkh.exe Token: SeDebugPrivilege 4632 skeaayld.exe Token: SeDebugPrivilege 1652 igxurrn.exe Token: SeDebugPrivilege 1236 twvurwl.exe Token: SeDebugPrivilege 3116 gtfzxajx.exe Token: SeDebugPrivilege 1284 xpisxvpg.exe Token: SeDebugPrivilege 4156 lkpmxhib.exe Token: SeDebugPrivilege 4616 vpltp.exe Token: SeDebugPrivilege 4984 qdjrfm.exe Token: SeDebugPrivilege 4576 ejclwdj.exe Token: SeDebugPrivilege 4992 ptvqkaxr.exe Token: SeDebugPrivilege 4388 vnuvbp.exe Token: SeDebugPrivilege 2632 iifzbzl.exe Token: SeDebugPrivilege 1316 mvgaxadb.exe Token: SeDebugPrivilege 3576 ikhzfx.exe Token: SeDebugPrivilege 4636 fncbwuf.exe Token: SeDebugPrivilege 3324 xlbtu.exe Token: SeDebugPrivilege 1224 kjhjabq.exe Token: SeDebugPrivilege 3316 bjbjbvd.exe Token: SeDebugPrivilege 960 tfpfbb.exe Token: SeDebugPrivilege 3820 culcdot.exe Token: SeDebugPrivilege 5060 pdnhtddx.exe Token: SeDebugPrivilege 4764 tnevvbek.exe Token: SeDebugPrivilege 4592 llqgex.exe Token: SeDebugPrivilege 4168 yxivif.exe Token: SeDebugPrivilege 748 katjzh.exe Token: SeDebugPrivilege 2276 vwwayks.exe Token: SeDebugPrivilege 3716 dppbkug.exe Token: SeDebugPrivilege 2304 wmxaz.exe Token: SeDebugPrivilege 4052 dfvhrv.exe Token: SeDebugPrivilege 3148 fvmuo.exe Token: SeDebugPrivilege 2008 nwtaiug.exe Token: SeDebugPrivilege 4332 rvywq.exe Token: SeDebugPrivilege 744 ffohs.exe Token: SeDebugPrivilege 4924 sxmka.exe Token: SeDebugPrivilege 4700 izxsxo.exe Token: SeDebugPrivilege 3956 xdpukyv.exe Token: SeDebugPrivilege 4920 wrqandkm.exe Token: SeDebugPrivilege 3848 suydr.exe Token: SeDebugPrivilege 4852 kfovdqgo.exe Token: SeDebugPrivilege 2104 vlllfo.exe Token: SeDebugPrivilege 2368 febnajw.exe Token: SeDebugPrivilege 1888 waobnhn.exe Token: SeDebugPrivilege 3856 twbngztj.exe Token: SeDebugPrivilege 1928 vaaws.exe Token: SeDebugPrivilege 4076 wsxhzg.exe Token: SeDebugPrivilege 420 ocetctym.exe Token: SeDebugPrivilege 3280 hmteej.exe Token: SeDebugPrivilege 3188 fbamlhw.exe Token: SeDebugPrivilege 4584 eepjba.exe Token: SeDebugPrivilege 1844 nuseg.exe Token: SeDebugPrivilege 5012 kpmllvcs.exe Token: SeDebugPrivilege 5020 noczh.exe Token: SeDebugPrivilege 556 qkxvelw.exe Token: SeDebugPrivilege 2400 xpguvi.exe Token: SeDebugPrivilege 4556 snblg.exe Token: SeDebugPrivilege 4468 vmrzlz.exe Token: SeDebugPrivilege 3308 iztgavi.exe Token: SeDebugPrivilege 4488 wmhxezni.exe Token: SeDebugPrivilege 2604 ublojb.exe Token: SeDebugPrivilege 2528 vllfn.exe Token: SeDebugPrivilege 1252 zdeiyqn.exe Token: SeDebugPrivilege 4288 cnsfs.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 692 3172 jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe 86 PID 692 wrote to memory of 4632 692 foqrdkh.exe 87 PID 4632 wrote to memory of 1652 4632 skeaayld.exe 88 PID 1652 wrote to memory of 1236 1652 igxurrn.exe 89 PID 1236 wrote to memory of 3116 1236 twvurwl.exe 90 PID 3116 wrote to memory of 1284 3116 gtfzxajx.exe 91 PID 1284 wrote to memory of 4156 1284 xpisxvpg.exe 92 PID 4156 wrote to memory of 4616 4156 lkpmxhib.exe 93 PID 4616 wrote to memory of 4984 4616 vpltp.exe 94 PID 4984 wrote to memory of 4576 4984 qdjrfm.exe 95 PID 4576 wrote to memory of 4992 4576 ejclwdj.exe 96 PID 4992 wrote to memory of 4388 4992 ptvqkaxr.exe 98 PID 4388 wrote to memory of 2632 4388 vnuvbp.exe 99 PID 2632 wrote to memory of 1316 2632 iifzbzl.exe 100 PID 1316 wrote to memory of 3576 1316 mvgaxadb.exe 101 PID 3576 wrote to memory of 4636 3576 ikhzfx.exe 102 PID 4636 wrote to memory of 3324 4636 fncbwuf.exe 103 PID 3324 wrote to memory of 1224 3324 xlbtu.exe 104 PID 1224 wrote to memory of 3316 1224 kjhjabq.exe 105 PID 3316 wrote to memory of 960 3316 bjbjbvd.exe 106 PID 960 wrote to memory of 3820 960 tfpfbb.exe 107 PID 3820 wrote to memory of 5060 3820 culcdot.exe 108 PID 5060 wrote to memory of 4764 5060 pdnhtddx.exe 110 PID 4764 wrote to memory of 4592 4764 tnevvbek.exe 111 PID 4592 wrote to memory of 4168 4592 llqgex.exe 112 PID 4168 wrote to memory of 748 4168 yxivif.exe 113 PID 748 wrote to memory of 2276 748 katjzh.exe 114 PID 2276 wrote to memory of 3716 2276 vwwayks.exe 115 PID 3716 wrote to memory of 2304 3716 dppbkug.exe 116 PID 2304 wrote to memory of 4052 2304 wmxaz.exe 117 PID 4052 wrote to memory of 3148 4052 dfvhrv.exe 118 PID 3148 wrote to memory of 2008 3148 fvmuo.exe 119 PID 2008 wrote to memory of 4332 2008 nwtaiug.exe 121 PID 4332 wrote to memory of 744 4332 rvywq.exe 122 PID 744 wrote to memory of 4924 744 ffohs.exe 123 PID 4924 wrote to memory of 4700 4924 sxmka.exe 124 PID 4700 wrote to memory of 3956 4700 izxsxo.exe 125 PID 3956 wrote to memory of 4920 3956 xdpukyv.exe 126 PID 4920 wrote to memory of 3848 4920 wrqandkm.exe 127 PID 3848 wrote to memory of 4852 3848 suydr.exe 128 PID 4852 wrote to memory of 2104 4852 kfovdqgo.exe 129 PID 2104 wrote to memory of 2368 2104 vlllfo.exe 130 PID 2368 wrote to memory of 1888 2368 febnajw.exe 131 PID 1888 wrote to memory of 3856 1888 waobnhn.exe 132 PID 3856 wrote to memory of 1928 3856 twbngztj.exe 133 PID 1928 wrote to memory of 4076 1928 vaaws.exe 134 PID 4076 wrote to memory of 420 4076 wsxhzg.exe 135 PID 420 wrote to memory of 3280 420 ocetctym.exe 136 PID 3280 wrote to memory of 3188 3280 hmteej.exe 137 PID 3188 wrote to memory of 4584 3188 fbamlhw.exe 138 PID 4584 wrote to memory of 1844 4584 eepjba.exe 139 PID 1844 wrote to memory of 5012 1844 nuseg.exe 140 PID 5012 wrote to memory of 5020 5012 kpmllvcs.exe 141 PID 5020 wrote to memory of 556 5020 noczh.exe 142 PID 556 wrote to memory of 2400 556 qkxvelw.exe 143 PID 2400 wrote to memory of 4556 2400 xpguvi.exe 144 PID 4556 wrote to memory of 4468 4556 snblg.exe 145 PID 4468 wrote to memory of 3308 4468 vmrzlz.exe 146 PID 3308 wrote to memory of 4488 3308 iztgavi.exe 147 PID 4488 wrote to memory of 2604 4488 wmhxezni.exe 148 PID 2604 wrote to memory of 2528 2604 ublojb.exe 149 PID 2528 wrote to memory of 1252 2528 vllfn.exe 150 PID 1252 wrote to memory of 4288 1252 zdeiyqn.exe 151 PID 4288 wrote to memory of 1588 4288 cnsfs.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\foqrdkh.exeC:\Windows\system32\foqrdkh.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\skeaayld.exeC:\Windows\system32\skeaayld.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\igxurrn.exeC:\Windows\system32\igxurrn.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\twvurwl.exeC:\Windows\system32\twvurwl.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\gtfzxajx.exeC:\Windows\system32\gtfzxajx.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\xpisxvpg.exeC:\Windows\system32\xpisxvpg.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\lkpmxhib.exeC:\Windows\system32\lkpmxhib.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\vpltp.exeC:\Windows\system32\vpltp.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\qdjrfm.exeC:\Windows\system32\qdjrfm.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\ejclwdj.exeC:\Windows\system32\ejclwdj.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\ptvqkaxr.exeC:\Windows\system32\ptvqkaxr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\vnuvbp.exeC:\Windows\system32\vnuvbp.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\iifzbzl.exeC:\Windows\system32\iifzbzl.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\mvgaxadb.exeC:\Windows\system32\mvgaxadb.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\ikhzfx.exeC:\Windows\system32\ikhzfx.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\fncbwuf.exeC:\Windows\system32\fncbwuf.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\xlbtu.exeC:\Windows\system32\xlbtu.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\kjhjabq.exeC:\Windows\system32\kjhjabq.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\bjbjbvd.exeC:\Windows\system32\bjbjbvd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\tfpfbb.exeC:\Windows\system32\tfpfbb.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\culcdot.exeC:\Windows\system32\culcdot.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\pdnhtddx.exeC:\Windows\system32\pdnhtddx.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\tnevvbek.exeC:\Windows\system32\tnevvbek.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\llqgex.exeC:\Windows\system32\llqgex.exe25⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\yxivif.exeC:\Windows\system32\yxivif.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\katjzh.exeC:\Windows\system32\katjzh.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\vwwayks.exeC:\Windows\system32\vwwayks.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\dppbkug.exeC:\Windows\system32\dppbkug.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\wmxaz.exeC:\Windows\system32\wmxaz.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\dfvhrv.exeC:\Windows\system32\dfvhrv.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\fvmuo.exeC:\Windows\system32\fvmuo.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\nwtaiug.exeC:\Windows\system32\nwtaiug.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rvywq.exeC:\Windows\system32\rvywq.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\ffohs.exeC:\Windows\system32\ffohs.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\sxmka.exeC:\Windows\system32\sxmka.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\izxsxo.exeC:\Windows\system32\izxsxo.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\xdpukyv.exeC:\Windows\system32\xdpukyv.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\wrqandkm.exeC:\Windows\system32\wrqandkm.exe39⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\suydr.exeC:\Windows\system32\suydr.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\kfovdqgo.exeC:\Windows\system32\kfovdqgo.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\vlllfo.exeC:\Windows\system32\vlllfo.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\febnajw.exeC:\Windows\system32\febnajw.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\waobnhn.exeC:\Windows\system32\waobnhn.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\twbngztj.exeC:\Windows\system32\twbngztj.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\vaaws.exeC:\Windows\system32\vaaws.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\wsxhzg.exeC:\Windows\system32\wsxhzg.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\ocetctym.exeC:\Windows\system32\ocetctym.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\hmteej.exeC:\Windows\system32\hmteej.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\fbamlhw.exeC:\Windows\system32\fbamlhw.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\eepjba.exeC:\Windows\system32\eepjba.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\nuseg.exeC:\Windows\system32\nuseg.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\kpmllvcs.exeC:\Windows\system32\kpmllvcs.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\noczh.exeC:\Windows\system32\noczh.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\qkxvelw.exeC:\Windows\system32\qkxvelw.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\xpguvi.exeC:\Windows\system32\xpguvi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\snblg.exeC:\Windows\system32\snblg.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\vmrzlz.exeC:\Windows\system32\vmrzlz.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\iztgavi.exeC:\Windows\system32\iztgavi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\wmhxezni.exeC:\Windows\system32\wmhxezni.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\ublojb.exeC:\Windows\system32\ublojb.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\vllfn.exeC:\Windows\system32\vllfn.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\zdeiyqn.exeC:\Windows\system32\zdeiyqn.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cnsfs.exeC:\Windows\system32\cnsfs.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\waonxzb.exeC:\Windows\system32\waonxzb.exe65⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\jqywxqa.exeC:\Windows\system32\jqywxqa.exe66⤵
- Adds Run key to start application
PID:4964 -
C:\Windows\SysWOW64\cfekfrw.exeC:\Windows\system32\cfekfrw.exe67⤵PID:2872
-
C:\Windows\SysWOW64\tqrbhmxu.exeC:\Windows\system32\tqrbhmxu.exe68⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Windows\SysWOW64\lzjjy.exeC:\Windows\system32\lzjjy.exe69⤵PID:4164
-
C:\Windows\SysWOW64\toegqw.exeC:\Windows\system32\toegqw.exe70⤵PID:5036
-
C:\Windows\SysWOW64\rffuossc.exeC:\Windows\system32\rffuossc.exe71⤵
- Drops file in System32 directory
PID:2060 -
C:\Windows\SysWOW64\qywjbri.exeC:\Windows\system32\qywjbri.exe72⤵PID:2136
-
C:\Windows\SysWOW64\rsojrmmp.exeC:\Windows\system32\rsojrmmp.exe73⤵PID:4000
-
C:\Windows\SysWOW64\dpndlwk.exeC:\Windows\system32\dpndlwk.exe74⤵PID:1348
-
C:\Windows\SysWOW64\ysguggdn.exeC:\Windows\system32\ysguggdn.exe75⤵PID:4184
-
C:\Windows\SysWOW64\ujiqami.exeC:\Windows\system32\ujiqami.exe76⤵PID:4188
-
C:\Windows\SysWOW64\ykuacf.exeC:\Windows\system32\ykuacf.exe77⤵PID:316
-
C:\Windows\SysWOW64\mfrutrso.exeC:\Windows\system32\mfrutrso.exe78⤵PID:4952
-
C:\Windows\SysWOW64\vfzukdvr.exeC:\Windows\system32\vfzukdvr.exe79⤵PID:4540
-
C:\Windows\SysWOW64\xeryhlzd.exeC:\Windows\system32\xeryhlzd.exe80⤵PID:3760
-
C:\Windows\SysWOW64\zsque.exeC:\Windows\system32\zsque.exe81⤵PID:1568
-
C:\Windows\SysWOW64\bluqstvr.exeC:\Windows\system32\bluqstvr.exe82⤵PID:3288
-
C:\Windows\SysWOW64\qpnwg.exeC:\Windows\system32\qpnwg.exe83⤵PID:4476
-
C:\Windows\SysWOW64\vcnxolb.exeC:\Windows\system32\vcnxolb.exe84⤵PID:2984
-
C:\Windows\SysWOW64\nomht.exeC:\Windows\system32\nomht.exe85⤵PID:2896
-
C:\Windows\SysWOW64\xuuurv.exeC:\Windows\system32\xuuurv.exe86⤵
- Drops file in System32 directory
PID:4256 -
C:\Windows\SysWOW64\ogsjqmy.exeC:\Windows\system32\ogsjqmy.exe87⤵PID:4400
-
C:\Windows\SysWOW64\xsmnn.exeC:\Windows\system32\xsmnn.exe88⤵PID:868
-
C:\Windows\SysWOW64\yivuyve.exeC:\Windows\system32\yivuyve.exe89⤵PID:5108
-
C:\Windows\SysWOW64\glxzlwn.exeC:\Windows\system32\glxzlwn.exe90⤵PID:3108
-
C:\Windows\SysWOW64\ihvekztt.exeC:\Windows\system32\ihvekztt.exe91⤵PID:3784
-
C:\Windows\SysWOW64\shsccsyv.exeC:\Windows\system32\shsccsyv.exe92⤵PID:4596
-
C:\Windows\SysWOW64\gljfvnw.exeC:\Windows\system32\gljfvnw.exe93⤵PID:1528
-
C:\Windows\SysWOW64\yrstzls.exeC:\Windows\system32\yrstzls.exe94⤵PID:3996
-
C:\Windows\SysWOW64\lbprwb.exeC:\Windows\system32\lbprwb.exe95⤵PID:2516
-
C:\Windows\SysWOW64\pucbqtt.exeC:\Windows\system32\pucbqtt.exe96⤵PID:4876
-
C:\Windows\SysWOW64\dddhc.exeC:\Windows\system32\dddhc.exe97⤵PID:3612
-
C:\Windows\SysWOW64\iuwwgvfn.exeC:\Windows\system32\iuwwgvfn.exe98⤵
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Windows\SysWOW64\unzugkbd.exeC:\Windows\system32\unzugkbd.exe99⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\nqdkf.exeC:\Windows\system32\nqdkf.exe100⤵PID:3392
-
C:\Windows\SysWOW64\aiitbmjz.exeC:\Windows\system32\aiitbmjz.exe101⤵PID:3512
-
C:\Windows\SysWOW64\oodiqdge.exeC:\Windows\system32\oodiqdge.exe102⤵PID:760
-
C:\Windows\SysWOW64\snbpu.exeC:\Windows\system32\snbpu.exe103⤵PID:1712
-
C:\Windows\SysWOW64\vhhlxwkk.exeC:\Windows\system32\vhhlxwkk.exe104⤵PID:2384
-
C:\Windows\SysWOW64\oucmw.exeC:\Windows\system32\oucmw.exe105⤵PID:1268
-
C:\Windows\SysWOW64\ayecjd.exeC:\Windows\system32\ayecjd.exe106⤵PID:5076
-
C:\Windows\SysWOW64\uhgayg.exeC:\Windows\system32\uhgayg.exe107⤵PID:212
-
C:\Windows\SysWOW64\wkpreypv.exeC:\Windows\system32\wkpreypv.exe108⤵PID:392
-
C:\Windows\SysWOW64\niwxyelj.exeC:\Windows\system32\niwxyelj.exe109⤵PID:3412
-
C:\Windows\SysWOW64\eukxeug.exeC:\Windows\system32\eukxeug.exe110⤵PID:1620
-
C:\Windows\SysWOW64\zlgrm.exeC:\Windows\system32\zlgrm.exe111⤵PID:5144
-
C:\Windows\SysWOW64\btrqiq.exeC:\Windows\system32\btrqiq.exe112⤵PID:5168
-
C:\Windows\SysWOW64\cdfooyg.exeC:\Windows\system32\cdfooyg.exe113⤵PID:5192
-
C:\Windows\SysWOW64\chnviid.exeC:\Windows\system32\chnviid.exe114⤵PID:5216
-
C:\Windows\SysWOW64\odinj.exeC:\Windows\system32\odinj.exe115⤵PID:5240
-
C:\Windows\SysWOW64\juaqgzb.exeC:\Windows\system32\juaqgzb.exe116⤵PID:5264
-
C:\Windows\SysWOW64\ewrybj.exeC:\Windows\system32\ewrybj.exe117⤵PID:5288
-
C:\Windows\SysWOW64\oziarrhu.exeC:\Windows\system32\oziarrhu.exe118⤵PID:5316
-
C:\Windows\SysWOW64\csrol.exeC:\Windows\system32\csrol.exe119⤵PID:5344
-
C:\Windows\SysWOW64\gnibdafj.exeC:\Windows\system32\gnibdafj.exe120⤵PID:5368
-
C:\Windows\SysWOW64\wkndt.exeC:\Windows\system32\wkndt.exe121⤵PID:5392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-