Overview

overview

7

Static

static

3

jaffacakes...81.exe

windows10-2004-x64

7

jaffacakes...81.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe
  • Size 33KB
  • Sample260925-xa78msxvbv
  • SHA256 8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:2444
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:960
    • C:\Windows\DiskMan32.exe
      C:\Windows\DiskMan32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5868
    • C:\Windows\vjzysm.exe
      C:\Windows\vjzysm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5824
    • C:\Windows\xmljdp.exe
      C:\Windows\xmljdp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5704
    • C:\Windows\yrhnyb.exe
      C:\Windows\yrhnyb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5512
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5932
      • C:\Windows\cpniks.exe
        C:\Windows\cpniks.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3392
      • C:\Windows\ctlwkl.exe
        C:\Windows\ctlwkl.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1696
      • C:\Windows\hgrvow.exe
        C:\Windows\hgrvow.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1936
      • C:\Windows\npayne.exe
        C:\Windows\npayne.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:472
      • C:\Windows\nfhhsv.exe
        C:\Windows\nfhhsv.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2608
      • C:\Windows\mfrius.exe
        C:\Windows\mfrius.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1352
      • C:\Windows\sswhyd.exe
        C:\Windows\sswhyd.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:796
      • C:\Windows\wnrxap.exe
        C:\Windows\wnrxap.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2808
      • C:\Windows\evygfg.exe
        C:\Windows\evygfg.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2836
      • C:\Windows\bxswgs.exe
        C:\Windows\bxswgs.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4156
      • C:\Windows\elhhmv.exe
        C:\Windows\elhhmv.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4960
      • C:\Windows\mqelhh.exe
        C:\Windows\mqelhh.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4264
      • C:\Windows\othwsk.exe
        C:\Windows\othwsk.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5152
      • C:\Windows\ugnvov.exe
        C:\Windows\ugnvov.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3284
      • C:\Windows\rltlkz.exe
        C:\Windows\rltlkz.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4600
      • C:\Windows\tltstf.exe
        C:\Windows\tltstf.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1236
      • C:\Windows\uegtxu.exe
        C:\Windows\uegtxu.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1632
      • C:\Windows\bbctat.exe
        C:\Windows\bbctat.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2408
      • C:\Windows\gvekkf.exe
        C:\Windows\gvekkf.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6248
      • C:\Windows\gabnes.exe
        C:\Windows\gabnes.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6424
      • C:\Windows\lrtpqu.exe
        C:\Windows\lrtpqu.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6576
      • C:\Windows\dyfvyk.exe
        C:\Windows\dyfvyk.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6788
      • C:\Windows\adnehc.exe
        C:\Windows\adnehc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6984
      • C:\Windows\looffy.exe
        C:\Windows\looffy.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6172
      • C:\Windows\iffimo.exe
        C:\Windows\iffimo.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6528
      • C:\Windows\qkcmgb.exe
        C:\Windows\qkcmgb.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2092
      • C:\Windows\tbckpz.exe
        C:\Windows\tbckpz.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3272
      • C:\Windows\yslnop.exe
        C:\Windows\yslnop.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4488
      • C:\Windows\gaselg.exe
        C:\Windows\gaselg.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3740
      • C:\Windows\drbiso.exe
        C:\Windows\drbiso.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3312
      • C:\Windows\fnqbqq.exe
        C:\Windows\fnqbqq.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6332
      • C:\Windows\lehewy.exe
        C:\Windows\lehewy.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6460
      • C:\Windows\ndhdfe.exe
        C:\Windows\ndhdfe.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3920
      • C:\Windows\uselie.exe
        C:\Windows\uselie.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2816
      • C:\Windows\ninhko.exe
        C:\Windows\ninhko.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5596
      • C:\Windows\sywljw.exe
        C:\Windows\sywljw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1820
      • C:\Windows\ubiwug.exe
        C:\Windows\ubiwug.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6912
      • C:\Windows\alchnf.exe
        C:\Windows\alchnf.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6804
      • C:\Windows\ffwyxr.exe
        C:\Windows\ffwyxr.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1556
      • C:\Windows\ctcotd.exe
        C:\Windows\ctcotd.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5500
      • C:\Windows\evoieg.exe
        C:\Windows\evoieg.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1368
      • C:\Windows\makdzs.exe
        C:\Windows\makdzs.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7112
      • C:\Windows\rueuim.exe
        C:\Windows\rueuim.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2544
      • C:\Windows\uueajl.exe
        C:\Windows\uueajl.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:564
      • C:\Windows\oitlpn.exe
        C:\Windows\oitlpn.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2124
      • C:\Windows\wqtume.exe
        C:\Windows\wqtume.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1296
      • C:\Windows\ytenxp.exe
        C:\Windows\ytenxp.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5424
      • C:\Windows\zigbzz.exe
        C:\Windows\zigbzz.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7320
      • C:\Windows\ecirbl.exe
        C:\Windows\ecirbl.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7488
      • C:\Windows\bqoqfo.exe
        C:\Windows\bqoqfo.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7640
      • C:\Windows\dpoofv.exe
        C:\Windows\dpoofv.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7792
      • C:\Windows\jcmnky.exe
        C:\Windows\jcmnky.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7992
      • C:\Windows\otdqio.exe
        C:\Windows\otdqio.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7284
      • C:\Windows\tkuupw.exe
        C:\Windows\tkuupw.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6532
      • C:\Windows\obuaqc.exe
        C:\Windows\obuaqc.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6904
      • C:\Windows\tpsyuf.exe
        C:\Windows\tpsyuf.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4308
      • C:\Windows\yfjctn.exe
        C:\Windows\yfjctn.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3436
      • C:\Windows\vkqkce.exe
        C:\Windows\vkqkce.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1268
      • C:\Windows\ygfeiy.exe
        C:\Windows\ygfeiy.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6972
      • C:\Windows\ysyziu.exe
        C:\Windows\ysyziu.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:6116
      • C:\Windows\dfeqmf.exe
        C:\Windows\dfeqmf.exe
        1⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3680
      • C:\Windows\ffwwme.exe
        C:\Windows\ffwwme.exe
        1⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:5628
      • C:\Windows\hhihyo.exe
        C:\Windows\hhihyo.exe
        1⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1816
      • C:\Windows\qmedsb.exe
        C:\Windows\qmedsb.exe
        1⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:8200
      • C:\Windows\qudmps.exe
        C:\Windows\qudmps.exe
        1⤵
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:8352
      • C:\Windows\sxpfbd.exe
        C:\Windows\sxpfbd.exe
        1⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:8504
      • C:\Windows\xoyihl.exe
        C:\Windows\xoyihl.exe
        1⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:8668
      • C:\Windows\cfpmgs.exe
        C:\Windows\cfpmgs.exe
        1⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:8828
      • C:\Windows\cbnaol.exe
        C:\Windows\cbnaol.exe
        1⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:8996
      • C:\Windows\cjvjlc.exe
        C:\Windows\cjvjlc.exe
        1⤵
        • System Location Discovery: System Language Discovery
        PID:9152

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            DiskMan32.exe
            • Path C:\Windows\DiskMan32.exe
            • Size 33KB
            • SHA256 8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiskMan32.dll
            • Path C:\Windows\SysWOW64\DiskMan32.dll
            • Size 25KB
            • SHA256 3555a068fceeccbf3d628906ac34098c41b405bb262f2cc0e916b5c139910e8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/472-120-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/796-155-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/960-36-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/1352-142-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/1696-98-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/1936-109-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/2092-392-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/2444-194-0x0000000005B90000-0x0000000005B91000-memory.dmp
            Download

            memory/2444-233-0x00000000091E0000-0x00000000091E1000-memory.dmp
            Download

            memory/2444-69-0x0000000006210000-0x0000000006211000-memory.dmp
            Download

            memory/2444-425-0x0000000009450000-0x0000000009451000-memory.dmp
            Download

            memory/2444-79-0x0000000006240000-0x0000000006241000-memory.dmp
            Download

            memory/2444-411-0x0000000009420000-0x0000000009421000-memory.dmp
            Download

            memory/2444-90-0x00000000072F0000-0x00000000072F1000-memory.dmp
            Download

            memory/2444-59-0x00000000061E0000-0x00000000061E1000-memory.dmp
            Download

            memory/2444-101-0x00000000073B0000-0x00000000073B1000-memory.dmp
            Download

            memory/2444-399-0x00000000088D0000-0x00000000088D1000-memory.dmp
            Download

            memory/2444-112-0x00000000073E0000-0x00000000073E1000-memory.dmp
            Download

            memory/2444-49-0x00000000035C0000-0x00000000035C1000-memory.dmp
            Download

            memory/2444-123-0x0000000007410000-0x0000000007411000-memory.dmp
            Download

            memory/2444-39-0x0000000006090000-0x0000000006091000-memory.dmp
            Download

            memory/2444-134-0x0000000007BF0000-0x0000000007BF1000-memory.dmp
            Download

            memory/2444-386-0x0000000009590000-0x0000000009591000-memory.dmp
            Download

            memory/2444-146-0x00000000072E0000-0x00000000072E1000-memory.dmp
            Download

            memory/2444-41-0x00000000060A0000-0x00000000060A1000-memory.dmp
            Download

            memory/2444-158-0x0000000005D70000-0x0000000005D71000-memory.dmp
            Download

            memory/2444-375-0x0000000006820000-0x0000000006821000-memory.dmp
            Download

            memory/2444-170-0x0000000005B30000-0x0000000005B31000-memory.dmp
            Download

            memory/2444-365-0x0000000009540000-0x0000000009541000-memory.dmp
            Download

            memory/2444-182-0x0000000005B60000-0x0000000005B61000-memory.dmp
            Download

            memory/2444-352-0x0000000009490000-0x0000000009491000-memory.dmp
            Download

            memory/2444-1-0x0000000003110000-0x0000000003111000-memory.dmp
            Download

            memory/2444-339-0x0000000008F80000-0x0000000008F81000-memory.dmp
            Download

            memory/2444-207-0x0000000008910000-0x0000000008911000-memory.dmp
            Download

            memory/2444-325-0x0000000008F50000-0x0000000008F51000-memory.dmp
            Download

            memory/2444-220-0x0000000008FC0000-0x0000000008FC1000-memory.dmp
            Download

            memory/2444-314-0x0000000006830000-0x0000000006831000-memory.dmp
            Download

            memory/2444-303-0x00000000067F0000-0x00000000067F1000-memory.dmp
            Download

            memory/2444-288-0x00000000067D0000-0x00000000067D1000-memory.dmp
            Download

            memory/2444-246-0x0000000009290000-0x0000000009291000-memory.dmp
            Download

            memory/2444-275-0x00000000093E0000-0x00000000093E1000-memory.dmp
            Download

            memory/2444-261-0x00000000091D0000-0x00000000091D1000-memory.dmp
            Download

            memory/2608-131-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/2808-167-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/2836-179-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/3272-404-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/3284-243-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/3392-87-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/4156-191-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/4264-217-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/4488-417-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/4600-252-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/4960-204-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/5152-230-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/5512-76-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/5704-66-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/5824-56-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/5868-46-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6172-370-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6248-299-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6528-381-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6576-332-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6788-345-0x0000000010000000-0x000000001000B000-memory.dmp
            Download

            memory/6984-357-0x0000000010000000-0x000000001000B000-memory.dmp
            Download