Overview

overview

7

Static

static

3

jaffacakes...82.exe

windows10-2004-x64

7

jaffacakes...82.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_1ab8c1b965a645cb6324b23acda91cd84dbacf291250efbce25aa272f8c74682.exe
  • Size 30KB
  • Sample260925-xdklravt4r
  • SHA256 1ab8c1b965a645cb6324b23acda91cd84dbacf291250efbce25aa272f8c74682
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 29 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1ab8c1b965a645cb6324b23acda91cd84dbacf291250efbce25aa272f8c74682.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1ab8c1b965a645cb6324b23acda91cd84dbacf291250efbce25aa272f8c74682.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4952
    • C:\Windows\DiskMan32.exe
      C:\Windows\DiskMan32.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5940
    • C:\Windows\vrkeoj.exe
      C:\Windows\vrkeoj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5932
    • C:\Windows\aekqtc.exe
      C:\Windows\aekqtc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4848
    • C:\Windows\frigxn.exe
      C:\Windows\frigxn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1572
    • C:\Windows\kizkwv.exe
      C:\Windows\kizkwv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1380
    • C:\Windows\nizqeb.exe
      C:\Windows\nizqeb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4564
    • C:\Windows\syqtdj.exe
      C:\Windows\syqtdj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4824
    • C:\Windows\rkbpdf.exe
      C:\Windows\rkbpdf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:776
    • C:\Windows\rozdlx.exe
      C:\Windows\rozdlx.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4492
    • C:\Windows\wfqgrf.exe
      C:\Windows\wfqgrf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6116
    • C:\Windows\enqpow.exe
      C:\Windows\enqpow.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5920
    • C:\Windows\hnqvxc.exe
      C:\Windows\hnqvxc.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3596
    • C:\Windows\esvutg.exe
      C:\Windows\esvutg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5756
    • C:\Windows\hrwscm.exe
      C:\Windows\hrwscm.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4556
    • C:\Windows\mfbryq.exe
      C:\Windows\mfbryq.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6000
    • C:\Windows\rwkuff.exe
      C:\Windows\rwkuff.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3716
    • C:\Windows\wmbydn.exe
      C:\Windows\wmbydn.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3164
    • C:\Windows\ushwzr.exe
      C:\Windows\ushwzr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2872
    • C:\Windows\zubmjl.exe
      C:\Windows\zubmjl.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5464
    • C:\Windows\elsqis.exe
      C:\Windows\elsqis.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
    • C:\Windows\gcswrz.exe
      C:\Windows\gcswrz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1352
    • C:\Windows\rkjcmr.exe
      C:\Windows\rkjcmr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2944
    • C:\Windows\jghqtk.exe
      C:\Windows\jghqtk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5044
    • C:\Windows\roozqb.exe
      C:\Windows\roozqb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3348
    • C:\Windows\wfxkxr.exe
      C:\Windows\wfxkxr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6252
    • C:\Windows\yeyjyp.exe
      C:\Windows\yeyjyp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6416
    • C:\Windows\dvpuff.exe
      C:\Windows\dvpuff.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6576
    • C:\Windows\xysfii.exe
      C:\Windows\xysfii.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6736
    • C:\Windows\diurjp.exe
      C:\Windows\diurjp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6896
    • C:\Windows\flycvr.exe
      C:\Windows\flycvr.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7056
    • C:\Windows\kbpfuh.exe
      C:\Windows\kbpfuh.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6280
    • C:\Windows\vfqgse.exe
      C:\Windows\vfqgse.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6744
    • C:\Windows\perfak.exe
      C:\Windows\perfak.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7044
    • C:\Windows\vrwdwo.exe
      C:\Windows\vrwdwo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2568
    • C:\Windows\alqtga.exe
      C:\Windows\alqtga.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:6816
    • C:\Windows\czfnec.exe
      C:\Windows\czfnec.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6500
    • C:\Windows\inldin.exe
      C:\Windows\inldin.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5964
    • C:\Windows\ivlmfe.exe
      C:\Windows\ivlmfe.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2492
    • C:\Windows\kulsod.exe
      C:\Windows\kulsod.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5832
    • C:\Windows\nqallf.exe
      C:\Windows\nqallf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3812
    • C:\Windows\uctzla.exe
      C:\Windows\uctzla.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5356
    • C:\Windows\aprype.exe
      C:\Windows\aprype.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1360
    • C:\Windows\xghbou.exe
      C:\Windows\xghbou.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1400
    • C:\Windows\zjtmaw.exe
      C:\Windows\zjtmaw.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7228
    • C:\Windows\ctxadu.exe
      C:\Windows\ctxadu.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7392
    • C:\Windows\hnrreg.exe
      C:\Windows\hnrreg.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7528
    • C:\Windows\jjgcki.exe
      C:\Windows\jjgcki.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:7676
    • C:\Windows\jrnlhz.exe
      C:\Windows\jrnlhz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7836
    • C:\Windows\luretk.exe
      C:\Windows\luretk.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8008
    • C:\Windows\oqgpqe.exe
      C:\Windows\oqgpqe.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8172
    • C:\Windows\wczlyz.exe
      C:\Windows\wczlyz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6016
    • C:\Windows\bsiwxp.exe
      C:\Windows\bsiwxp.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7704
    • C:\Windows\wdtdaf.exe
      C:\Windows\wdtdaf.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1640
    • C:\Windows\bucgzv.exe
      C:\Windows\bucgzv.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7184
    • C:\Windows\dtdeit.exe
      C:\Windows\dtdeit.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6688
    • C:\Windows\gsdliz.exe
      C:\Windows\gsdliz.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6604
    • C:\Windows\igseob.exe
      C:\Windows\igseob.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:6432
    • C:\Windows\gxjhvj.exe
      C:\Windows\gxjhvj.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6724
    • C:\Windows\iwbnvi.exe
      C:\Windows\iwbnvi.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8216
    • C:\Windows\nnsrcx.exe
      C:\Windows\nnsrcx.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8364
    • C:\Windows\tayhyb.exe
      C:\Windows\tayhyb.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8544
    • C:\Windows\vlboby.exe
      C:\Windows\vlboby.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8720
    • C:\Windows\tcszag.exe
      C:\Windows\tcszag.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:8944
    • C:\Windows\vewkmr.exe
      C:\Windows\vewkmr.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:9156
    • C:\Windows\asbbiu.exe
      C:\Windows\asbbiu.exe
      1⤵
      • Adds Run key to start application
      PID:6552
    • C:\Windows\fjsmok.exe
      C:\Windows\fjsmok.exe
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6768
    • C:\Windows\hlwxan.exe
      C:\Windows\hlwxan.exe
      1⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5468
    • C:\Windows\fzcwwy.exe
      C:\Windows\fzcwwy.exe
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:9112
    • C:\Windows\ijnczo.exe
      C:\Windows\ijnczo.exe
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8436
    • C:\Windows\ndhtbi.exe
      C:\Windows\ndhtbi.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:8664
    • C:\Windows\srnjxl.exe
      C:\Windows\srnjxl.exe
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:9024
    • C:\Windows\rcixkn.exe
      C:\Windows\rcixkn.exe
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      PID:3036
    • C:\Windows\rkigpe.exe
      C:\Windows\rkigpe.exe
      1⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      PID:4916
    • C:\Windows\uyxzng.exe
      C:\Windows\uyxzng.exe
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2284

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DiskMan32.exe
          • Path C:\Windows\DiskMan32.exe
          • Size 30KB
          • SHA256 1ab8c1b965a645cb6324b23acda91cd84dbacf291250efbce25aa272f8c74682
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiskMan32.dll
          • Path C:\Windows\SysWOW64\DiskMan32.dll
          • Size 22KB
          • SHA256 8756878a93a8f6885bd41f45cd70e8a6eefa2fad1c64cffb4a9c279967349bf9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/776-116-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1352-277-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1380-84-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/1572-73-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2736-264-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2872-237-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/2940-202-0x0000000009D70000-0x0000000009D71000-memory.dmp
          Download

          memory/2940-153-0x0000000004120000-0x0000000004121000-memory.dmp
          Download

          memory/2940-418-0x000000000A890000-0x000000000A891000-memory.dmp
          Download

          memory/2940-76-0x00000000081D0000-0x00000000081D1000-memory.dmp
          Download

          memory/2940-56-0x0000000006750000-0x0000000006751000-memory.dmp
          Download

          memory/2940-87-0x0000000008370000-0x0000000008371000-memory.dmp
          Download

          memory/2940-405-0x000000000A7E0000-0x000000000A7E1000-memory.dmp
          Download

          memory/2940-97-0x0000000008A30000-0x0000000008A31000-memory.dmp
          Download

          memory/2940-391-0x000000000A730000-0x000000000A731000-memory.dmp
          Download

          memory/2940-108-0x0000000008AF0000-0x0000000008AF1000-memory.dmp
          Download

          memory/2940-378-0x000000000A670000-0x000000000A671000-memory.dmp
          Download

          memory/2940-119-0x00000000097A0000-0x00000000097A1000-memory.dmp
          Download

          memory/2940-365-0x000000000A5C0000-0x000000000A5C1000-memory.dmp
          Download

          memory/2940-130-0x00000000097D0000-0x00000000097D1000-memory.dmp
          Download

          memory/2940-351-0x000000000A510000-0x000000000A511000-memory.dmp
          Download

          memory/2940-142-0x0000000008360000-0x0000000008361000-memory.dmp
          Download

          memory/2940-337-0x000000000A460000-0x000000000A461000-memory.dmp
          Download

          memory/2940-267-0x000000000A0F0000-0x000000000A0F1000-memory.dmp
          Download

          memory/2940-322-0x000000000A3B0000-0x000000000A3B1000-memory.dmp
          Download

          memory/2940-165-0x0000000009830000-0x0000000009831000-memory.dmp
          Download

          memory/2940-66-0x0000000006C40000-0x0000000006C41000-memory.dmp
          Download

          memory/2940-177-0x0000000009B10000-0x0000000009B11000-memory.dmp
          Download

          memory/2940-308-0x00000000099D0000-0x00000000099D1000-memory.dmp
          Download

          memory/2940-189-0x0000000009BD0000-0x0000000009BD1000-memory.dmp
          Download

          memory/2940-294-0x0000000009ED0000-0x0000000009ED1000-memory.dmp
          Download

          memory/2940-1-0x0000000003950000-0x0000000003951000-memory.dmp
          Download

          memory/2940-46-0x00000000065B0000-0x00000000065B1000-memory.dmp
          Download

          memory/2940-214-0x0000000009E20000-0x0000000009E21000-memory.dmp
          Download

          memory/2940-253-0x000000000A040000-0x000000000A041000-memory.dmp
          Download

          memory/2940-227-0x0000000009EE0000-0x0000000009EE1000-memory.dmp
          Download

          memory/2940-48-0x00000000065C0000-0x00000000065C1000-memory.dmp
          Download

          memory/2940-240-0x0000000009F90000-0x0000000009F91000-memory.dmp
          Download

          memory/2940-280-0x000000000A1A0000-0x000000000A1A1000-memory.dmp
          Download

          memory/2944-291-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3164-224-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3348-319-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3596-162-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/3716-211-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4492-127-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4556-186-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4564-94-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4824-105-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4848-63-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/4952-36-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5044-305-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5464-250-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5756-174-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5920-150-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/5932-53-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6000-199-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6116-139-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6252-334-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6280-415-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6416-348-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6576-362-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6736-375-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/6896-388-0x0000000010000000-0x0000000010009000-memory.dmp
          Download

          memory/7056-402-0x0000000010000000-0x0000000010009000-memory.dmp
          Download