Overview

overview

7

Static

static

3

jaffacakes...b5.exe

windows10-2004-x64

7

jaffacakes...b5.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe
  • Size 28KB
  • Sample260925-xbgr3stfqa
  • SHA256 2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:2848
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2948
    • C:\Windows\DiskMan32.exe
      C:\Windows\DiskMan32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4880
    • C:\Windows\iaxouk.exe
      C:\Windows\iaxouk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3980
    • C:\Windows\qmijcf.exe
      C:\Windows\qmijcf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4264
    • C:\Windows\quqszx.exe
      C:\Windows\quqszx.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1632
    • C:\Windows\vhoqva.exe
      C:\Windows\vhoqva.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3452
    • C:\Windows\npjuqk.exe
      C:\Windows\npjuqk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2612
    • C:\Windows\tupluo.exe
      C:\Windows\tupluo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5580
    • C:\Windows\ylgwtd.exe
      C:\Windows\ylgwtd.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:612
    • C:\Windows\vnancp.exe
      C:\Windows\vnancp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5216
    • C:\Windows\yyetxn.exe
      C:\Windows\yyetxn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5704
    • C:\Windows\fjxpxj.exe
      C:\Windows\fjxpxj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3064
    • C:\Windows\hmaajl.exe
      C:\Windows\hmaajl.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2456
    • C:\Windows\nwulcs.exe
      C:\Windows\nwulcs.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1544
    • C:\Windows\hvvklr.exe
      C:\Windows\hvvklr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4132
    • C:\Windows\mqpaul.exe
      C:\Windows\mqpaul.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2072
    • C:\Windows\pppgvj.exe
      C:\Windows\pppgvj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4764
    • C:\Windows\xxxpaa.exe
      C:\Windows\xxxpaa.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4472
    • C:\Windows\ckcgwm.exe
      C:\Windows\ckcgwm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5388
    • C:\Windows\wcvmfk.exe
      C:\Windows\wcvmfk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1336
    • C:\Windows\evoieg.exe
      C:\Windows\evoieg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4308
    • C:\Windows\kbtyar.exe
      C:\Windows\kbtyar.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5968
    • C:\Windows\mmxrmu.exe
      C:\Windows\mmxrmu.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
    • C:\Windows\rrciif.exe
      C:\Windows\rrciif.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3956
    • C:\Windows\mqdoqe.exe
      C:\Windows\mqdoqe.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3860
    • C:\Windows\rhmrxt.exe
      C:\Windows\rhmrxt.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3728
    • C:\Windows\tdjlvn.exe
      C:\Windows\tdjlvn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:592
    • C:\Windows\yurocd.exe
      C:\Windows\yurocd.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5320
    • C:\Windows\blsmdb.exe
      C:\Windows\blsmdb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6224
    • C:\Windows\bqoqfo.exe
      C:\Windows\bqoqfo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6380
    • C:\Windows\ggxtee.exe
      C:\Windows\ggxtee.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6544
    • C:\Windows\lbzkfq.exe
      C:\Windows\lbzkfq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6736
    • C:\Windows\rofijt.exe
      C:\Windows\rofijt.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6900
    • C:\Windows\wfomij.exe
      C:\Windows\wfomij.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7060
    • C:\Windows\tzqcsv.exe
      C:\Windows\tzqcsv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6256
    • C:\Windows\tsddxk.exe
      C:\Windows\tsddxk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6584
    • C:\Windows\yfjctn.exe
      C:\Windows\yfjctn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4840
    • C:\Windows\dwafad.exe
      C:\Windows\dwafad.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7092
    • C:\Windows\fzdqdg.exe
      C:\Windows\fzdqdg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4240
    • C:\Windows\aydxmm.exe
      C:\Windows\aydxmm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4144
    • C:\Windows\idasgz.exe
      C:\Windows\idasgz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3988
    • C:\Windows\kgderj.exe
      C:\Windows\kgderj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3632
    • C:\Windows\nqpsmz.exe
      C:\Windows\nqpsmz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1092
    • C:\Windows\vypbrq.exe
      C:\Windows\vypbrq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6096
    • C:\Windows\pbamvb.exe
      C:\Windows\pbamvb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7176
    • C:\Windows\xgwixo.exe
      C:\Windows\xgwixo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7332
    • C:\Windows\cxflwv.exe
      C:\Windows\cxflwv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7496
    • C:\Windows\iowwvl.exe
      C:\Windows\iowwvl.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7660
    • C:\Windows\kqaigo.exe
      C:\Windows\kqaigo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7816
    • C:\Windows\kvwdab.exe
      C:\Windows\kvwdab.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7980
    • C:\Windows\myixml.exe
      C:\Windows\myixml.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:8136
    • C:\Windows\puxisn.exe
      C:\Windows\puxisn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7240
    • C:\Windows\xytmma.exe
      C:\Windows\xytmma.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7412
    • C:\Windows\zqlkuz.exe
      C:\Windows\zqlkuz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:972
    • C:\Windows\uplqvf.exe
      C:\Windows\uplqvf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:7936
    • C:\Windows\zgctcn.exe
      C:\Windows\zgctcn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5832
    • C:\Windows\bcrnap.exe
      C:\Windows\bcrnap.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6896
    • C:\Windows\hpxdes.exe
      C:\Windows\hpxdes.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:8048
    • C:\Windows\mygpdi.exe
      C:\Windows\mygpdi.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
    • C:\Windows\lzncqm.exe
      C:\Windows\lzncqm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6192
    • C:\Windows\moxqkw.exe
      C:\Windows\moxqkw.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:792
    • C:\Windows\rfgcre.exe
      C:\Windows\rfgcre.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6724
    • C:\Windows\wzistq.exe
      C:\Windows\wzistq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:8348
    • C:\Windows\bqrwzg.exe
      C:\Windows\bqrwzg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:8504
    • C:\Windows\vprcae.exe
      C:\Windows\vprcae.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:8656
    • C:\Windows\bzmfbl.exe
      C:\Windows\bzmfbl.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8808
    • C:\Windows\azvgmi.exe
      C:\Windows\azvgmi.exe
      1⤵
      • Adds Run key to start application
      PID:8988
    • C:\Windows\lhuuhb.exe
      C:\Windows\lhuuhb.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:9196
    • C:\Windows\oymbih.exe
      C:\Windows\oymbih.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8432
    • C:\Windows\ixmzqn.exe
      C:\Windows\ixmzqn.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:8736
    • C:\Windows\ltbswh.exe
      C:\Windows\ltbswh.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6044
    • C:\Windows\pndiyc.exe
      C:\Windows\pndiyc.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7116
    • C:\Windows\vpyuzb.exe
      C:\Windows\vpyuzb.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8304
    • C:\Windows\vxhnjy.exe
      C:\Windows\vxhnjy.exe
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      PID:6460
    • C:\Windows\slnlfb.exe
      C:\Windows\slnlfb.exe
      1⤵
      • System Location Discovery: System Language Discovery
      PID:6280

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DiskMan32.exe
          • Path C:\Windows\DiskMan32.exe
          • Size 28KB
          • SHA256 2ff7496ecd8a0b94a61aab0d2ef7a9cdba4dc57eae1df59d4dd31f1a32a2d7b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiskMan32.dll
          • Path C:\Windows\SysWOW64\DiskMan32.dll
          • Size 19KB
          • SHA256 09eba83b46d15cee946e6a8afabdf824cf026e2b5ff0d437b6a4bea9687833da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/592-354-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/612-118-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1336-254-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1544-177-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1632-73-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2072-202-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2456-165-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2612-96-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2848-193-0x00000000084E0000-0x00000000084E1000-memory.dmp
          Download

          memory/2848-328-0x00000000090C0000-0x00000000090C1000-memory.dmp
          Download

          memory/2848-77-0x0000000003360000-0x0000000003361000-memory.dmp
          Download

          memory/2848-412-0x00000000095C0000-0x00000000095C1000-memory.dmp
          Download

          memory/2848-88-0x0000000005A30000-0x0000000005A31000-memory.dmp
          Download

          memory/2848-398-0x00000000095A0000-0x00000000095A1000-memory.dmp
          Download

          memory/2848-99-0x0000000005A60000-0x0000000005A61000-memory.dmp
          Download

          memory/2848-384-0x0000000006690000-0x0000000006691000-memory.dmp
          Download

          memory/2848-110-0x0000000005E10000-0x0000000005E11000-memory.dmp
          Download

          memory/2848-57-0x0000000003310000-0x0000000003311000-memory.dmp
          Download

          memory/2848-121-0x0000000005EC0000-0x0000000005EC1000-memory.dmp
          Download

          memory/2848-372-0x00000000092D0000-0x00000000092D1000-memory.dmp
          Download

          memory/2848-133-0x0000000005EF0000-0x0000000005EF1000-memory.dmp
          Download

          memory/2848-358-0x00000000091A0000-0x00000000091A1000-memory.dmp
          Download

          memory/2848-145-0x00000000065F0000-0x00000000065F1000-memory.dmp
          Download

          memory/2848-67-0x0000000003340000-0x0000000003341000-memory.dmp
          Download

          memory/2848-157-0x00000000058C0000-0x00000000058C1000-memory.dmp
          Download

          memory/2848-286-0x0000000008E90000-0x0000000008E91000-memory.dmp
          Download

          memory/2848-169-0x00000000066D0000-0x00000000066D1000-memory.dmp
          Download

          memory/2848-47-0x00000000037B0000-0x00000000037B1000-memory.dmp
          Download

          memory/2848-181-0x00000000084B0000-0x00000000084B1000-memory.dmp
          Download

          memory/2848-343-0x0000000009170000-0x0000000009171000-memory.dmp
          Download

          memory/2848-1-0x0000000002810000-0x0000000002811000-memory.dmp
          Download

          memory/2848-49-0x0000000005990000-0x0000000005991000-memory.dmp
          Download

          memory/2848-206-0x00000000058B0000-0x00000000058B1000-memory.dmp
          Download

          memory/2848-272-0x0000000008DE0000-0x0000000008DE1000-memory.dmp
          Download

          memory/2848-219-0x0000000008520000-0x0000000008521000-memory.dmp
          Download

          memory/2848-314-0x00000000066A0000-0x00000000066A1000-memory.dmp
          Download

          memory/2848-232-0x0000000008AD0000-0x0000000008AD1000-memory.dmp
          Download

          memory/2848-300-0x0000000008FD0000-0x0000000008FD1000-memory.dmp
          Download

          memory/2848-245-0x0000000008B80000-0x0000000008B81000-memory.dmp
          Download

          memory/2848-258-0x0000000008D30000-0x0000000008D31000-memory.dmp
          Download

          memory/2872-296-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2948-35-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3064-153-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3452-85-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3728-339-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3860-324-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3956-310-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3980-53-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4132-189-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4264-63-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4308-268-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4472-228-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4764-215-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4880-43-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5216-130-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5320-368-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5388-241-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5580-107-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5704-141-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5968-282-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6224-381-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6380-395-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6544-409-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6736-422-0x0000000010000000-0x0000000010009000-memory.dmp
          Download