Analysis
- max time kernel
40s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 22:31
Behavioral task
behavioral1
Sample
jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe
- Size 9KB
- Sample260919-2fmlcatz5j
- SHA256 022dba6141f7a6af45717743048b36cc5a148ca0494536e79fe0a3789c9efc88
- MD5 2d804bec8b656e0bfa4ba06885a65f31
- SHA1 31599ef353965cff0cd3dbd36dd416b3b73eef47
- SHA512 152fe320d268d77368af7efb07720ce678b2b65c6f2d1ecb9f7c8cb84854a5c2f769516ec800f0ee8c993d0e292c6a7bbb8af500b94b5d56a6d717d579c5fed2
- SSDEEP 192:5VSCS71IPrpeFa0XAxAWi0GEqhdHdfnXZZ9Tw5:7iuo3XUAWi0GEqh5BJZ9e
- TLSH T122128F83C0763BD5E08A0478C4D3B5D43BFE5576D6AACB53C3923615385EB72258CE12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4980 znqpd.exe 4560 wfumy.exe 1564 zwwges.exe 1056 mpleec.exe 5912 xazupb.exe 4528 qqlpql.exe 4516 nbxcyak.exe 3376 xihkbbr.exe 4104 cqsurgod.exe 988 hzhth.exe 4928 autexcu.exe 5480 gkfxoke.exe 1248 dqciuzkf.exe 2232 cripj.exe 4100 rsoydxx.exe 4892 mvhhlgsv.exe 4524 ibmalyp.exe 52 xoxhcq.exe 2728 grqzbqq.exe 4140 rtnhhek.exe 4492 opsbvub.exe 4480 kwflm.exe 4720 rlrhcv.exe 5596 dgpxjgfl.exe 4332 ujjde.exe 3676 cvwcers.exe 1976 gulzu.exe 1676 yhxghyn.exe 5072 uxayh.exe 3892 lumew.exe 1364 znlwvvnn.exe 6052 eyjkjorn.exe 1964 wzqgxbv.exe 6136 mrygf.exe 5600 iipmpjod.exe 2608 pbtfc.exe 4436 yuwimm.exe 3336 gynmlaoh.exe 5296 dmiagdni.exe 796 lmvct.exe 4200 fcbyy.exe 3684 jofgcm.exe 5764 gmwzacl.exe 3952 rnejsf.exe 4484 hvklex.exe 2516 exlervb.exe 4264 ihqkd.exe 4252 qkuzsfwk.exe 2880 uahxr.exe 2504 zadorw.exe 5948 kmfrzp.exe 1196 dsypi.exe 2176 zlklimxy.exe 1256 fifueh.exe 2552 baziyatw.exe 4420 mxyzoddv.exe 1484 ysnxe.exe 5512 whurzif.exe 5848 lvcdbojo.exe 5080 ggoinzw.exe 3704 qaquoyn.exe 4620 wrpugce.exe 2908 exqncwva.exe 3588 lfpiape.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\admuymsh.exe" ewnsbhqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\emwctojb.exe" xpgocgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\phixofre.exe" xguol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\oknjkom.exe" lfpiape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\swyxdama.exe" pqwypph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kecco.exe" gmpro.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\zbbif.exe" owramj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lrfwrxa.exe" gsyoeby.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dbtplq.exe" qvwlje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uxayh.exe" yhxghyn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dsypi.exe" kmfrzp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\maojthj.exe" mwjvta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\igccwhz.exe" gqmoko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uhmfp.exe" oesfhhrt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\sgxbez.exe" lhlixva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\hgvnp.exe" xwerz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\whurzif.exe" ysnxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\xoczn.exe" ycnnowez.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\rcpxjj.exe" maojthj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\zeguovs.exe" lcvtad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\fmtyxuoh.exe" wiynp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\pwrhlhup.exe" nxuajen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kynfuoi.exe" fsqqkyey.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\cjrqp.exe" rvehftl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\emqwekv.exe" rpbmcgx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\fqmpes.exe" myzvf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lexlkz.exe" cstts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\mrfjjrz.exe" demhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\farlq.exe" surzjpsu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\nzoadces.exe" ewdmhqw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\umiin.exe" iogqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\aokvlc.exe" tjrteux.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\tnjmgbzk.exe" lnogxxs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\dozfr.exe" rfucxk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wznfcv.exe" imzwrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\hxjxcui.exe" igvff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wkluon.exe" iryufhw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bhtnllkr.exe" rxetql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bnfhq.exe" hukixq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\rwnuzaa.exe" mvikz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\jyjpdkxr.exe" ecwzlc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ggztvyrj.exe" duluyxno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\pgposc.exe" ipbnypc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\adrlqvgh.exe" lcqwv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bhstgfjs.exe" hkoyhnix.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\bajbps.exe" farlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kmzwsk.exe" rzqudt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\gynmlaoh.exe" yuwimm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\aizbvzvg.exe" frnnmlgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lmzfee.exe" atsjydgz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\morskmpj.exe" rlvkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\ikkptd.exe" dlwvei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\jyyrxj.exe" uzsajjuy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\hvklex.exe" rnejsf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\xohmqdn.exe" efsexr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uzsajjuy.exe" gsggm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\uiclcu.exe" mkjyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\odkcd.exe" uwxewym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\wybnlzbx.exe" xrlttb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\kejxqxjs.exe" pigttyo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\lwjkvnwq.exe" hsczp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\fymvfw.exe" arljd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\yvzxzd.exe" qpifbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\system32\\mciravwk.exe" hlfal.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\duhdrv.exe eebym.exe File created C:\Windows\SysWOW64\yewapma.exe rdebavuu.exe File created C:\Windows\SysWOW64\pcmwn.exe xtoou.exe File created C:\Windows\SysWOW64\ztgtjte.exe qqxrdwst.exe File created C:\Windows\SysWOW64\vkmsr.exe pcjtirpa.exe File created C:\Windows\SysWOW64\rwmhmm.exe lgbizill.exe File created C:\Windows\SysWOW64\pgjolecm.exe scuwi.exe File created C:\Windows\SysWOW64\rotwyg.exe emwctojb.exe File created C:\Windows\SysWOW64\gcotv.exe rhbcia.exe File created C:\Windows\SysWOW64\iddfeemm.exe ikkptd.exe File created C:\Windows\SysWOW64\lczrmhsg.exe wznlh.exe File created C:\Windows\SysWOW64\ecwzlc.exe nadnk.exe File created C:\Windows\SysWOW64\xsczl.exe ztjrsmg.exe File created C:\Windows\SysWOW64\lepbdlrl.exe bevrt.exe File created C:\Windows\SysWOW64\uahxr.exe qkuzsfwk.exe File created C:\Windows\SysWOW64\skdiwfzg.exe xohmqdn.exe File created C:\Windows\SysWOW64\xoczn.exe ycnnowez.exe File created C:\Windows\SysWOW64\xzbjolqq.exe uiroi.exe File created C:\Windows\SysWOW64\voisk.exe mrvdk.exe File created C:\Windows\SysWOW64\qbbtrwk.exe vqrgn.exe File created C:\Windows\SysWOW64\ajlexr.exe eugixgc.exe File created C:\Windows\SysWOW64\rwimv.exe swsqdi.exe File created C:\Windows\SysWOW64\pqwypph.exe rnkdr.exe File created C:\Windows\SysWOW64\phixofre.exe xguol.exe File created C:\Windows\SysWOW64\yyhqhmvl.exe fcgazzky.exe File created C:\Windows\SysWOW64\pghzbcr.exe ssqsfm.exe File created C:\Windows\SysWOW64\qxssogdm.exe cuylh.exe File created C:\Windows\SysWOW64\demhp.exe kpmugdxs.exe File created C:\Windows\SysWOW64\kejxqxjs.exe pigttyo.exe File created C:\Windows\SysWOW64\bybaovug.exe buodc.exe File created C:\Windows\SysWOW64\uxayh.exe yhxghyn.exe File created C:\Windows\SysWOW64\tjrteux.exe ciwmi.exe File created C:\Windows\SysWOW64\jmnyej.exe lenvfbql.exe File created C:\Windows\SysWOW64\nadnk.exe xbkgcy.exe File created C:\Windows\SysWOW64\gqmoko.exe vvkdap.exe File created C:\Windows\SysWOW64\gsyoeby.exe gyxcz.exe File created C:\Windows\SysWOW64\cabagne.exe tqszfh.exe File created C:\Windows\SysWOW64\ptmkm.exe vviyzq.exe File created C:\Windows\SysWOW64\gsqiupdc.exe xrdvmcgd.exe File created C:\Windows\SysWOW64\fqitagab.exe mwkmpjy.exe File created C:\Windows\SysWOW64\nifix.exe wblzhjfh.exe File created C:\Windows\SysWOW64\gjdsztkf.exe ykhxnugh.exe File created C:\Windows\SysWOW64\zakfv.exe umiin.exe File created C:\Windows\SysWOW64\ibmalyp.exe mvhhlgsv.exe File created C:\Windows\SysWOW64\baiacxve.exe yyhqhmvl.exe File created C:\Windows\SysWOW64\ewhedzqu.exe wugknn.exe File created C:\Windows\SysWOW64\yotmn.exe yvjfbt.exe File created C:\Windows\SysWOW64\tuecl.exe qzeop.exe File created C:\Windows\SysWOW64\myuzogjk.exe ccziylz.exe File created C:\Windows\SysWOW64\zkcnyy.exe lakdej.exe File created C:\Windows\SysWOW64\hckqkd.exe egntgjpy.exe File created C:\Windows\SysWOW64\vleextn.exe sdumzv.exe File created C:\Windows\SysWOW64\iytmov.exe dryruj.exe File created C:\Windows\SysWOW64\hsczp.exe fcaoz.exe File created C:\Windows\SysWOW64\whhbphq.exe pcmwn.exe File created C:\Windows\SysWOW64\jhgbijsq.exe qeraz.exe File created C:\Windows\SysWOW64\rnkdr.exe npeuqri.exe File created C:\Windows\SysWOW64\vqbwq.exe lfikq.exe File created C:\Windows\SysWOW64\pxeekbm.exe bmhtyufz.exe File created C:\Windows\SysWOW64\eaxkf.exe uiclcu.exe File created C:\Windows\SysWOW64\myauub.exe lrfwrxa.exe File created C:\Windows\SysWOW64\qpsofzy.exe koroh.exe File created C:\Windows\SysWOW64\xoxhcq.exe ibmalyp.exe File created C:\Windows\SysWOW64\lumew.exe uxayh.exe -
resource yara_rule behavioral2/memory/5560-0-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/files/0x000600000001b857-1.dat upx behavioral2/memory/5560-11-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4980-13-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4560-15-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4104-23-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/1248-28-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/2232-30-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4100-32-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4524-35-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/6748-98-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/7196-105-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/7896-107-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/11180-140-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/3876-662-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/18376-2914-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/15312-3118-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/14812-3142-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/8616-4072-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/8392-4441-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/8976-4603-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/17296-4861-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/11744-4940-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/4116-6366-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/10636-7062-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/7184-7351-0x0000000031000000-0x000000003100A000-memory.dmp upx behavioral2/memory/5628-8480-0x0000000031000000-0x000000003100A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kqtzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kmfrzp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zatayw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfiog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kupwn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ugysnymr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iigho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvehftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exqncwva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oqulnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avttpqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vleextn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbfkmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxxae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ikfgofi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nehpny.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpiape.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language illkmsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zsxcum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alczv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language umiin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gkfxoke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qkuzsfwk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxlttu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjuvoiwu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsovr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iitrer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language egntgjpy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ukoqsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cabagne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dgpxjgfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language efsexr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cjcxyvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvtot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhbucdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yxvlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bkrfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hupggio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvvfja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aokvlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rcpxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sqytf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ouhytia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language imwjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfzmtkvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language asdbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uahxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsypi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpbmcgx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acaplvog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jyyrxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cstts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhghao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fkrazznx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmvct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yitunj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wkluon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mrvdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhamwiv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qbpzboff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnyfrlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language utxdgop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grqzbqq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anmxfty.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5560 jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe Token: SeDebugPrivilege 4980 znqpd.exe Token: SeDebugPrivilege 4560 wfumy.exe Token: SeDebugPrivilege 1564 zwwges.exe Token: SeDebugPrivilege 1056 mpleec.exe Token: SeDebugPrivilege 5912 xazupb.exe Token: SeDebugPrivilege 4528 qqlpql.exe Token: SeDebugPrivilege 4516 nbxcyak.exe Token: SeDebugPrivilege 3376 xihkbbr.exe Token: SeDebugPrivilege 4104 cqsurgod.exe Token: SeDebugPrivilege 988 hzhth.exe Token: SeDebugPrivilege 4928 autexcu.exe Token: SeDebugPrivilege 5480 gkfxoke.exe Token: SeDebugPrivilege 1248 dqciuzkf.exe Token: SeDebugPrivilege 2232 cripj.exe Token: SeDebugPrivilege 4100 rsoydxx.exe Token: SeDebugPrivilege 4892 mvhhlgsv.exe Token: SeDebugPrivilege 4524 ibmalyp.exe Token: SeDebugPrivilege 52 xoxhcq.exe Token: SeDebugPrivilege 2728 grqzbqq.exe Token: SeDebugPrivilege 4140 rtnhhek.exe Token: SeDebugPrivilege 4492 opsbvub.exe Token: SeDebugPrivilege 4480 kwflm.exe Token: SeDebugPrivilege 4720 rlrhcv.exe Token: SeDebugPrivilege 5596 dgpxjgfl.exe Token: SeDebugPrivilege 4332 ujjde.exe Token: SeDebugPrivilege 3676 cvwcers.exe Token: SeDebugPrivilege 1976 gulzu.exe Token: SeDebugPrivilege 1676 yhxghyn.exe Token: SeDebugPrivilege 5072 uxayh.exe Token: SeDebugPrivilege 3892 lumew.exe Token: SeDebugPrivilege 1364 znlwvvnn.exe Token: SeDebugPrivilege 6052 eyjkjorn.exe Token: SeDebugPrivilege 1964 wzqgxbv.exe Token: SeDebugPrivilege 6136 mrygf.exe Token: SeDebugPrivilege 5600 iipmpjod.exe Token: SeDebugPrivilege 2608 pbtfc.exe Token: SeDebugPrivilege 4436 yuwimm.exe Token: SeDebugPrivilege 3336 gynmlaoh.exe Token: SeDebugPrivilege 5296 dmiagdni.exe Token: SeDebugPrivilege 796 lmvct.exe Token: SeDebugPrivilege 4200 fcbyy.exe Token: SeDebugPrivilege 3684 jofgcm.exe Token: SeDebugPrivilege 5764 gmwzacl.exe Token: SeDebugPrivilege 3952 rnejsf.exe Token: SeDebugPrivilege 4484 hvklex.exe Token: SeDebugPrivilege 2516 exlervb.exe Token: SeDebugPrivilege 4264 ihqkd.exe Token: SeDebugPrivilege 4252 qkuzsfwk.exe Token: SeDebugPrivilege 2880 uahxr.exe Token: SeDebugPrivilege 2504 zadorw.exe Token: SeDebugPrivilege 5948 kmfrzp.exe Token: SeDebugPrivilege 1196 dsypi.exe Token: SeDebugPrivilege 2176 zlklimxy.exe Token: SeDebugPrivilege 1256 fifueh.exe Token: SeDebugPrivilege 2552 baziyatw.exe Token: SeDebugPrivilege 4420 mxyzoddv.exe Token: SeDebugPrivilege 1484 ysnxe.exe Token: SeDebugPrivilege 5512 whurzif.exe Token: SeDebugPrivilege 5848 lvcdbojo.exe Token: SeDebugPrivilege 5080 ggoinzw.exe Token: SeDebugPrivilege 3704 qaquoyn.exe Token: SeDebugPrivilege 4620 wrpugce.exe Token: SeDebugPrivilege 2908 exqncwva.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5560 wrote to memory of 4980 5560 jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe 89 PID 4980 wrote to memory of 4560 4980 znqpd.exe 90 PID 4560 wrote to memory of 1564 4560 wfumy.exe 91 PID 1564 wrote to memory of 1056 1564 zwwges.exe 92 PID 1056 wrote to memory of 5912 1056 mpleec.exe 93 PID 5912 wrote to memory of 4528 5912 xazupb.exe 94 PID 4528 wrote to memory of 4516 4528 qqlpql.exe 95 PID 4516 wrote to memory of 3376 4516 nbxcyak.exe 96 PID 3376 wrote to memory of 4104 3376 xihkbbr.exe 97 PID 4104 wrote to memory of 988 4104 cqsurgod.exe 98 PID 988 wrote to memory of 4928 988 hzhth.exe 99 PID 4928 wrote to memory of 5480 4928 autexcu.exe 100 PID 5480 wrote to memory of 1248 5480 gkfxoke.exe 101 PID 1248 wrote to memory of 2232 1248 dqciuzkf.exe 102 PID 2232 wrote to memory of 4100 2232 cripj.exe 103 PID 4100 wrote to memory of 4892 4100 rsoydxx.exe 105 PID 4892 wrote to memory of 4524 4892 mvhhlgsv.exe 106 PID 4524 wrote to memory of 52 4524 ibmalyp.exe 107 PID 52 wrote to memory of 2728 52 xoxhcq.exe 108 PID 2728 wrote to memory of 4140 2728 grqzbqq.exe 109 PID 4140 wrote to memory of 4492 4140 rtnhhek.exe 110 PID 4492 wrote to memory of 4480 4492 opsbvub.exe 111 PID 4480 wrote to memory of 4720 4480 kwflm.exe 112 PID 4720 wrote to memory of 5596 4720 rlrhcv.exe 113 PID 5596 wrote to memory of 4332 5596 dgpxjgfl.exe 114 PID 4332 wrote to memory of 3676 4332 ujjde.exe 115 PID 3676 wrote to memory of 1976 3676 cvwcers.exe 116 PID 1976 wrote to memory of 1676 1976 gulzu.exe 117 PID 1676 wrote to memory of 5072 1676 yhxghyn.exe 118 PID 5072 wrote to memory of 3892 5072 uxayh.exe 120 PID 3892 wrote to memory of 1364 3892 lumew.exe 121 PID 1364 wrote to memory of 6052 1364 znlwvvnn.exe 122 PID 6052 wrote to memory of 1964 6052 eyjkjorn.exe 123 PID 1964 wrote to memory of 6136 1964 wzqgxbv.exe 124 PID 6136 wrote to memory of 5600 6136 mrygf.exe 125 PID 5600 wrote to memory of 2608 5600 iipmpjod.exe 126 PID 2608 wrote to memory of 4436 2608 pbtfc.exe 127 PID 4436 wrote to memory of 3336 4436 yuwimm.exe 128 PID 3336 wrote to memory of 5296 3336 gynmlaoh.exe 129 PID 5296 wrote to memory of 796 5296 dmiagdni.exe 130 PID 796 wrote to memory of 4200 796 lmvct.exe 131 PID 4200 wrote to memory of 3684 4200 fcbyy.exe 132 PID 3684 wrote to memory of 5764 3684 jofgcm.exe 133 PID 5764 wrote to memory of 3952 5764 gmwzacl.exe 134 PID 3952 wrote to memory of 4484 3952 rnejsf.exe 135 PID 4484 wrote to memory of 2516 4484 hvklex.exe 136 PID 2516 wrote to memory of 4264 2516 exlervb.exe 137 PID 4264 wrote to memory of 4252 4264 ihqkd.exe 138 PID 4252 wrote to memory of 2880 4252 qkuzsfwk.exe 139 PID 2880 wrote to memory of 2504 2880 uahxr.exe 140 PID 2504 wrote to memory of 5948 2504 zadorw.exe 141 PID 5948 wrote to memory of 1196 5948 kmfrzp.exe 142 PID 1196 wrote to memory of 2176 1196 dsypi.exe 143 PID 2176 wrote to memory of 1256 2176 zlklimxy.exe 144 PID 1256 wrote to memory of 2552 1256 fifueh.exe 145 PID 2552 wrote to memory of 4420 2552 baziyatw.exe 146 PID 4420 wrote to memory of 1484 4420 mxyzoddv.exe 147 PID 1484 wrote to memory of 5512 1484 ysnxe.exe 148 PID 5512 wrote to memory of 5848 5512 whurzif.exe 149 PID 5848 wrote to memory of 5080 5848 lvcdbojo.exe 150 PID 5080 wrote to memory of 3704 5080 ggoinzw.exe 151 PID 3704 wrote to memory of 4620 3704 qaquoyn.exe 152 PID 4620 wrote to memory of 2908 4620 wrpugce.exe 153 PID 2908 wrote to memory of 3588 2908 exqncwva.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d804bec8b656e0bfa4ba06885a65f31.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\znqpd.exeC:\Windows\system32\znqpd.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\wfumy.exeC:\Windows\system32\wfumy.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\zwwges.exeC:\Windows\system32\zwwges.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\mpleec.exeC:\Windows\system32\mpleec.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\xazupb.exeC:\Windows\system32\xazupb.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\qqlpql.exeC:\Windows\system32\qqlpql.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\nbxcyak.exeC:\Windows\system32\nbxcyak.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\xihkbbr.exeC:\Windows\system32\xihkbbr.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cqsurgod.exeC:\Windows\system32\cqsurgod.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\hzhth.exeC:\Windows\system32\hzhth.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\autexcu.exeC:\Windows\system32\autexcu.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\gkfxoke.exeC:\Windows\system32\gkfxoke.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\dqciuzkf.exeC:\Windows\system32\dqciuzkf.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cripj.exeC:\Windows\system32\cripj.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\rsoydxx.exeC:\Windows\system32\rsoydxx.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\mvhhlgsv.exeC:\Windows\system32\mvhhlgsv.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\ibmalyp.exeC:\Windows\system32\ibmalyp.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\xoxhcq.exeC:\Windows\system32\xoxhcq.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\grqzbqq.exeC:\Windows\system32\grqzbqq.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rtnhhek.exeC:\Windows\system32\rtnhhek.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\opsbvub.exeC:\Windows\system32\opsbvub.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\kwflm.exeC:\Windows\system32\kwflm.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\rlrhcv.exeC:\Windows\system32\rlrhcv.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\dgpxjgfl.exeC:\Windows\system32\dgpxjgfl.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\ujjde.exeC:\Windows\system32\ujjde.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cvwcers.exeC:\Windows\system32\cvwcers.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\gulzu.exeC:\Windows\system32\gulzu.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\yhxghyn.exeC:\Windows\system32\yhxghyn.exe29⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\uxayh.exeC:\Windows\system32\uxayh.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\lumew.exeC:\Windows\system32\lumew.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\znlwvvnn.exeC:\Windows\system32\znlwvvnn.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\eyjkjorn.exeC:\Windows\system32\eyjkjorn.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\wzqgxbv.exeC:\Windows\system32\wzqgxbv.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\mrygf.exeC:\Windows\system32\mrygf.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\iipmpjod.exeC:\Windows\system32\iipmpjod.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\pbtfc.exeC:\Windows\system32\pbtfc.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\yuwimm.exeC:\Windows\system32\yuwimm.exe38⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\gynmlaoh.exeC:\Windows\system32\gynmlaoh.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\dmiagdni.exeC:\Windows\system32\dmiagdni.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\lmvct.exeC:\Windows\system32\lmvct.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\fcbyy.exeC:\Windows\system32\fcbyy.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\jofgcm.exeC:\Windows\system32\jofgcm.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\gmwzacl.exeC:\Windows\system32\gmwzacl.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\rnejsf.exeC:\Windows\system32\rnejsf.exe45⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\hvklex.exeC:\Windows\system32\hvklex.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\exlervb.exeC:\Windows\system32\exlervb.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\ihqkd.exeC:\Windows\system32\ihqkd.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\qkuzsfwk.exeC:\Windows\system32\qkuzsfwk.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\uahxr.exeC:\Windows\system32\uahxr.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\zadorw.exeC:\Windows\system32\zadorw.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\kmfrzp.exeC:\Windows\system32\kmfrzp.exe52⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\dsypi.exeC:\Windows\system32\dsypi.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\zlklimxy.exeC:\Windows\system32\zlklimxy.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\fifueh.exeC:\Windows\system32\fifueh.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\baziyatw.exeC:\Windows\system32\baziyatw.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\mxyzoddv.exeC:\Windows\system32\mxyzoddv.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\ysnxe.exeC:\Windows\system32\ysnxe.exe58⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\whurzif.exeC:\Windows\system32\whurzif.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\lvcdbojo.exeC:\Windows\system32\lvcdbojo.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\ggoinzw.exeC:\Windows\system32\ggoinzw.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\qaquoyn.exeC:\Windows\system32\qaquoyn.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\wrpugce.exeC:\Windows\system32\wrpugce.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\exqncwva.exeC:\Windows\system32\exqncwva.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\lfpiape.exeC:\Windows\system32\lfpiape.exe65⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\oknjkom.exeC:\Windows\system32\oknjkom.exe66⤵PID:3436
-
C:\Windows\SysWOW64\ntciyqk.exeC:\Windows\system32\ntciyqk.exe67⤵PID:4520
-
C:\Windows\SysWOW64\cvvxxwm.exeC:\Windows\system32\cvvxxwm.exe68⤵PID:5396
-
C:\Windows\SysWOW64\lcqwv.exeC:\Windows\system32\lcqwv.exe69⤵
- Adds Run key to start application
PID:3004 -
C:\Windows\SysWOW64\adrlqvgh.exeC:\Windows\system32\adrlqvgh.exe70⤵PID:3076
-
C:\Windows\SysWOW64\ufeare.exeC:\Windows\system32\ufeare.exe71⤵PID:2348
-
C:\Windows\SysWOW64\guycog.exeC:\Windows\system32\guycog.exe72⤵PID:4248
-
C:\Windows\SysWOW64\fcrvdgy.exeC:\Windows\system32\fcrvdgy.exe73⤵PID:3540
-
C:\Windows\SysWOW64\agdrvh.exeC:\Windows\system32\agdrvh.exe74⤵PID:6044
-
C:\Windows\SysWOW64\efsexr.exeC:\Windows\system32\efsexr.exe75⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\xohmqdn.exeC:\Windows\system32\xohmqdn.exe76⤵
- Drops file in System32 directory
PID:3292 -
C:\Windows\SysWOW64\skdiwfzg.exeC:\Windows\system32\skdiwfzg.exe77⤵PID:5920
-
C:\Windows\SysWOW64\zyfphbx.exeC:\Windows\system32\zyfphbx.exe78⤵PID:3140
-
C:\Windows\SysWOW64\adfbp.exeC:\Windows\system32\adfbp.exe79⤵PID:4872
-
C:\Windows\SysWOW64\ktner.exeC:\Windows\system32\ktner.exe80⤵PID:2320
-
C:\Windows\SysWOW64\mtfyep.exeC:\Windows\system32\mtfyep.exe81⤵PID:2104
-
C:\Windows\SysWOW64\hlvvfja.exeC:\Windows\system32\hlvvfja.exe82⤵
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\gqhnxgjc.exeC:\Windows\system32\gqhnxgjc.exe83⤵PID:5552
-
C:\Windows\SysWOW64\wrmzql.exeC:\Windows\system32\wrmzql.exe84⤵PID:468
-
C:\Windows\SysWOW64\eyalnldf.exeC:\Windows\system32\eyalnldf.exe85⤵PID:1620
-
C:\Windows\SysWOW64\aofilehr.exeC:\Windows\system32\aofilehr.exe86⤵PID:1952
-
C:\Windows\SysWOW64\beyiswwb.exeC:\Windows\system32\beyiswwb.exe87⤵PID:4084
-
C:\Windows\SysWOW64\vkydape.exeC:\Windows\system32\vkydape.exe88⤵PID:6032
-
C:\Windows\SysWOW64\xtoou.exeC:\Windows\system32\xtoou.exe89⤵
- Drops file in System32 directory
PID:4092 -
C:\Windows\SysWOW64\pcmwn.exeC:\Windows\system32\pcmwn.exe90⤵
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\whhbphq.exeC:\Windows\system32\whhbphq.exe91⤵PID:5464
-
C:\Windows\SysWOW64\gsmdk.exeC:\Windows\system32\gsmdk.exe92⤵PID:4792
-
C:\Windows\SysWOW64\scuwi.exeC:\Windows\system32\scuwi.exe93⤵
- Drops file in System32 directory
PID:1616 -
C:\Windows\SysWOW64\pgjolecm.exeC:\Windows\system32\pgjolecm.exe94⤵PID:5044
-
C:\Windows\SysWOW64\olsgjsw.exeC:\Windows\system32\olsgjsw.exe95⤵PID:708
-
C:\Windows\SysWOW64\icqyrb.exeC:\Windows\system32\icqyrb.exe96⤵PID:1344
-
C:\Windows\SysWOW64\xxxquux.exeC:\Windows\system32\xxxquux.exe97⤵PID:2952
-
C:\Windows\SysWOW64\yznsqg.exeC:\Windows\system32\yznsqg.exe98⤵PID:4080
-
C:\Windows\SysWOW64\jiqtofn.exeC:\Windows\system32\jiqtofn.exe99⤵PID:3728
-
C:\Windows\SysWOW64\jkeuviz.exeC:\Windows\system32\jkeuviz.exe100⤵PID:5500
-
C:\Windows\SysWOW64\otbumqn.exeC:\Windows\system32\otbumqn.exe101⤵PID:2672
-
C:\Windows\SysWOW64\cspqdtcf.exeC:\Windows\system32\cspqdtcf.exe102⤵PID:6076
-
C:\Windows\SysWOW64\dftzgz.exeC:\Windows\system32\dftzgz.exe103⤵PID:2720
-
C:\Windows\SysWOW64\oqulnn.exeC:\Windows\system32\oqulnn.exe104⤵
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\mensboge.exeC:\Windows\system32\mensboge.exe105⤵PID:1960
-
C:\Windows\SysWOW64\yitunj.exeC:\Windows\system32\yitunj.exe106⤵
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\shhrbbrd.exeC:\Windows\system32\shhrbbrd.exe107⤵PID:5368
-
C:\Windows\SysWOW64\wrsby.exeC:\Windows\system32\wrsby.exe108⤵PID:3392
-
C:\Windows\SysWOW64\avttpqa.exeC:\Windows\system32\avttpqa.exe109⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\zqdtfcg.exeC:\Windows\system32\zqdtfcg.exe110⤵PID:5032
-
C:\Windows\SysWOW64\ciwmi.exeC:\Windows\system32\ciwmi.exe111⤵
- Drops file in System32 directory
PID:5064 -
C:\Windows\SysWOW64\tjrteux.exeC:\Windows\system32\tjrteux.exe112⤵
- Adds Run key to start application
PID:2912 -
C:\Windows\SysWOW64\aokvlc.exeC:\Windows\system32\aokvlc.exe113⤵
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Windows\SysWOW64\pqsdioo.exeC:\Windows\system32\pqsdioo.exe114⤵PID:120
-
C:\Windows\SysWOW64\gkvlh.exeC:\Windows\system32\gkvlh.exe115⤵PID:1980
-
C:\Windows\SysWOW64\ranmpm.exeC:\Windows\system32\ranmpm.exe116⤵PID:4380
-
C:\Windows\SysWOW64\epiwvk.exeC:\Windows\system32\epiwvk.exe117⤵PID:3516
-
C:\Windows\SysWOW64\uwbzhc.exeC:\Windows\system32\uwbzhc.exe118⤵PID:1236
-
C:\Windows\SysWOW64\aawakzyj.exeC:\Windows\system32\aawakzyj.exe119⤵PID:1252
-
C:\Windows\SysWOW64\qxpgss.exeC:\Windows\system32\qxpgss.exe120⤵PID:1692
-
C:\Windows\SysWOW64\ukurvfef.exeC:\Windows\system32\ukurvfef.exe121⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-