Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
- Size 232KB
- Sample261002-leew4sshpc
- SHA256 3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c
- MD5 cec00acc7e14574d54d88f328745c740
- SHA1 dcc9dfbfbac901c8d543eec6dafdbac8cc077d4f
- SHA512 3d7767c337ae6e41f5095528585c5d28dee2cf4e695cb32b1e549e0322fd9457f717954fb63dae09fac5b2e0c3920099ea7f8cc73eb64070d583889e7538cd99
- SSDEEP 3072:C05vMnlurPPNJrf/Zy50Vgqq4+tiam3n/C8hmxOUUr3dtAiLF:C05hrPFJr3G0Vpr+tiaOhh4arDv
- TLSH T1593428BEBB02823AE111007C8D0A56B569563E342D2998EBF3D1FF1D24F51E76639387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3496 lLObvSj.exe 1564 lLObvSj.exe 3456 lLObvSj.exe 2248 lLObvSj.exe 1148 lLObvSj.exe 1888 lLObvSj.exe 2540 lLObvSj.exe 4284 lLObvSj.exe 3820 lLObvSj.exe 2084 lLObvSj.exe 1056 lLObvSj.exe 5060 lLObvSj.exe 3132 lLObvSj.exe 3052 lLObvSj.exe 4824 lLObvSj.exe 4660 lLObvSj.exe 1468 lLObvSj.exe 1952 lLObvSj.exe 2812 lLObvSj.exe 1168 lLObvSj.exe 3876 lLObvSj.exe 4632 lLObvSj.exe 208 lLObvSj.exe 4836 lLObvSj.exe 3976 lLObvSj.exe 5112 lLObvSj.exe 1436 lLObvSj.exe 3176 lLObvSj.exe 2420 lLObvSj.exe 1716 lLObvSj.exe 1476 lLObvSj.exe 1804 lLObvSj.exe 3384 lLObvSj.exe 4732 lLObvSj.exe 4592 lLObvSj.exe 1908 lLObvSj.exe 4384 lLObvSj.exe 1028 lLObvSj.exe 2016 lLObvSj.exe 2856 lLObvSj.exe 4300 lLObvSj.exe 2272 lLObvSj.exe 4268 lLObvSj.exe 1988 lLObvSj.exe 2548 lLObvSj.exe 3160 lLObvSj.exe 1668 lLObvSj.exe 4192 lLObvSj.exe 2712 lLObvSj.exe 3020 lLObvSj.exe 416 lLObvSj.exe 3120 lLObvSj.exe 1432 lLObvSj.exe 2304 lLObvSj.exe 4272 lLObvSj.exe 384 lLObvSj.exe 3320 lLObvSj.exe 4044 lLObvSj.exe 1104 lLObvSj.exe 548 lLObvSj.exe 4884 lLObvSj.exe 2536 lLObvSj.exe 2576 lLObvSj.exe 2936 lLObvSj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\e: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\e: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\q: lLObvSj.exe File opened (read-only) \??\m: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\n: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\j: lLObvSj.exe File opened (read-only) \??\s: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\e: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe File opened (read-only) \??\t: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\r: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\t: lLObvSj.exe File opened (read-only) \??\j: lLObvSj.exe File opened (read-only) \??\t: lLObvSj.exe File opened (read-only) \??\g: lLObvSj.exe File opened (read-only) \??\q: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\s: lLObvSj.exe File opened (read-only) \??\k: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\g: lLObvSj.exe File opened (read-only) \??\j: lLObvSj.exe File opened (read-only) \??\r: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\x: lLObvSj.exe File opened (read-only) \??\k: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\s: lLObvSj.exe File opened (read-only) \??\m: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe File opened (read-only) \??\m: lLObvSj.exe File opened (read-only) \??\g: lLObvSj.exe File opened (read-only) \??\n: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\t: lLObvSj.exe File opened (read-only) \??\x: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\g: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\m: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\g: lLObvSj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe - Program crash 1 IoCs
pid pid_target Process 48516 14452 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 2132 jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe Token: SeLoadDriverPrivilege 3496 lLObvSj.exe Token: SeLoadDriverPrivilege 1564 lLObvSj.exe Token: SeLoadDriverPrivilege 3456 lLObvSj.exe Token: SeLoadDriverPrivilege 2248 lLObvSj.exe Token: SeLoadDriverPrivilege 1148 lLObvSj.exe Token: SeLoadDriverPrivilege 1888 lLObvSj.exe Token: SeLoadDriverPrivilege 2540 lLObvSj.exe Token: SeLoadDriverPrivilege 4284 lLObvSj.exe Token: SeLoadDriverPrivilege 3820 lLObvSj.exe Token: SeLoadDriverPrivilege 2084 lLObvSj.exe Token: SeLoadDriverPrivilege 1056 lLObvSj.exe Token: SeLoadDriverPrivilege 5060 lLObvSj.exe Token: SeLoadDriverPrivilege 3132 lLObvSj.exe Token: SeLoadDriverPrivilege 3052 lLObvSj.exe Token: SeLoadDriverPrivilege 4824 lLObvSj.exe Token: SeLoadDriverPrivilege 4660 lLObvSj.exe Token: SeLoadDriverPrivilege 1468 lLObvSj.exe Token: SeLoadDriverPrivilege 1952 lLObvSj.exe Token: SeLoadDriverPrivilege 2812 lLObvSj.exe Token: SeLoadDriverPrivilege 1168 lLObvSj.exe Token: SeLoadDriverPrivilege 3876 lLObvSj.exe Token: SeLoadDriverPrivilege 4632 lLObvSj.exe Token: SeLoadDriverPrivilege 208 lLObvSj.exe Token: SeLoadDriverPrivilege 4836 lLObvSj.exe Token: SeLoadDriverPrivilege 3976 lLObvSj.exe Token: SeLoadDriverPrivilege 5112 lLObvSj.exe Token: SeLoadDriverPrivilege 1436 lLObvSj.exe Token: SeLoadDriverPrivilege 3176 lLObvSj.exe Token: SeLoadDriverPrivilege 2420 lLObvSj.exe Token: SeLoadDriverPrivilege 1716 lLObvSj.exe Token: SeLoadDriverPrivilege 1476 lLObvSj.exe Token: SeLoadDriverPrivilege 1804 lLObvSj.exe Token: SeLoadDriverPrivilege 3384 lLObvSj.exe Token: SeLoadDriverPrivilege 4732 lLObvSj.exe Token: SeLoadDriverPrivilege 4592 lLObvSj.exe Token: SeLoadDriverPrivilege 1908 lLObvSj.exe Token: SeLoadDriverPrivilege 4384 lLObvSj.exe Token: SeLoadDriverPrivilege 1028 lLObvSj.exe Token: SeLoadDriverPrivilege 2016 lLObvSj.exe Token: SeLoadDriverPrivilege 2856 lLObvSj.exe Token: SeLoadDriverPrivilege 4300 lLObvSj.exe Token: SeLoadDriverPrivilege 2272 lLObvSj.exe Token: SeLoadDriverPrivilege 4268 lLObvSj.exe Token: SeLoadDriverPrivilege 1988 lLObvSj.exe Token: SeLoadDriverPrivilege 2548 lLObvSj.exe Token: SeLoadDriverPrivilege 3160 lLObvSj.exe Token: SeLoadDriverPrivilege 1668 lLObvSj.exe Token: SeLoadDriverPrivilege 4192 lLObvSj.exe Token: SeLoadDriverPrivilege 2712 lLObvSj.exe Token: SeLoadDriverPrivilege 3020 lLObvSj.exe Token: SeLoadDriverPrivilege 416 lLObvSj.exe Token: SeLoadDriverPrivilege 3120 lLObvSj.exe Token: SeLoadDriverPrivilege 1432 lLObvSj.exe Token: SeLoadDriverPrivilege 2304 lLObvSj.exe Token: SeLoadDriverPrivilege 4272 lLObvSj.exe Token: SeLoadDriverPrivilege 384 lLObvSj.exe Token: SeLoadDriverPrivilege 3320 lLObvSj.exe Token: SeLoadDriverPrivilege 4044 lLObvSj.exe Token: SeLoadDriverPrivilege 1104 lLObvSj.exe Token: SeLoadDriverPrivilege 548 lLObvSj.exe Token: SeLoadDriverPrivilege 4884 lLObvSj.exe Token: SeLoadDriverPrivilege 2536 lLObvSj.exe Token: SeLoadDriverPrivilege 2576 lLObvSj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3496 2132 jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe 90 PID 3496 wrote to memory of 1564 3496 lLObvSj.exe 91 PID 1564 wrote to memory of 3456 1564 lLObvSj.exe 92 PID 3456 wrote to memory of 2248 3456 lLObvSj.exe 93 PID 2248 wrote to memory of 1148 2248 lLObvSj.exe 94 PID 1148 wrote to memory of 1888 1148 lLObvSj.exe 95 PID 1888 wrote to memory of 2540 1888 lLObvSj.exe 96 PID 2540 wrote to memory of 4284 2540 lLObvSj.exe 97 PID 4284 wrote to memory of 3820 4284 lLObvSj.exe 98 PID 3820 wrote to memory of 2084 3820 lLObvSj.exe 99 PID 2084 wrote to memory of 1056 2084 lLObvSj.exe 100 PID 1056 wrote to memory of 5060 1056 lLObvSj.exe 101 PID 5060 wrote to memory of 3132 5060 lLObvSj.exe 102 PID 3132 wrote to memory of 3052 3132 lLObvSj.exe 103 PID 3052 wrote to memory of 4824 3052 lLObvSj.exe 104 PID 4824 wrote to memory of 4660 4824 lLObvSj.exe 105 PID 4660 wrote to memory of 1468 4660 lLObvSj.exe 106 PID 1468 wrote to memory of 1952 1468 lLObvSj.exe 107 PID 1952 wrote to memory of 2812 1952 lLObvSj.exe 108 PID 2812 wrote to memory of 1168 2812 lLObvSj.exe 109 PID 1168 wrote to memory of 3876 1168 lLObvSj.exe 110 PID 3876 wrote to memory of 4632 3876 lLObvSj.exe 111 PID 4632 wrote to memory of 208 4632 lLObvSj.exe 112 PID 208 wrote to memory of 4836 208 lLObvSj.exe 113 PID 4836 wrote to memory of 3976 4836 lLObvSj.exe 114 PID 3976 wrote to memory of 5112 3976 lLObvSj.exe 115 PID 5112 wrote to memory of 1436 5112 lLObvSj.exe 117 PID 1436 wrote to memory of 3176 1436 lLObvSj.exe 118 PID 3176 wrote to memory of 2420 3176 lLObvSj.exe 119 PID 2420 wrote to memory of 1716 2420 lLObvSj.exe 120 PID 1716 wrote to memory of 1476 1716 lLObvSj.exe 122 PID 1476 wrote to memory of 1804 1476 lLObvSj.exe 123 PID 1804 wrote to memory of 3384 1804 lLObvSj.exe 124 PID 3384 wrote to memory of 4732 3384 lLObvSj.exe 125 PID 4732 wrote to memory of 4592 4732 lLObvSj.exe 126 PID 4592 wrote to memory of 1908 4592 lLObvSj.exe 127 PID 1908 wrote to memory of 4384 1908 lLObvSj.exe 128 PID 4384 wrote to memory of 1028 4384 lLObvSj.exe 129 PID 1028 wrote to memory of 2016 1028 lLObvSj.exe 130 PID 2016 wrote to memory of 2856 2016 lLObvSj.exe 131 PID 2856 wrote to memory of 4300 2856 lLObvSj.exe 132 PID 4300 wrote to memory of 2272 4300 lLObvSj.exe 133 PID 2272 wrote to memory of 4268 2272 lLObvSj.exe 134 PID 4268 wrote to memory of 1988 4268 lLObvSj.exe 135 PID 1988 wrote to memory of 2548 1988 lLObvSj.exe 136 PID 2548 wrote to memory of 3160 2548 lLObvSj.exe 137 PID 3160 wrote to memory of 1668 3160 lLObvSj.exe 138 PID 1668 wrote to memory of 4192 1668 lLObvSj.exe 139 PID 4192 wrote to memory of 2712 4192 lLObvSj.exe 140 PID 2712 wrote to memory of 3020 2712 lLObvSj.exe 141 PID 3020 wrote to memory of 416 3020 lLObvSj.exe 142 PID 416 wrote to memory of 3120 416 lLObvSj.exe 143 PID 3120 wrote to memory of 1432 3120 lLObvSj.exe 144 PID 1432 wrote to memory of 2304 1432 lLObvSj.exe 145 PID 2304 wrote to memory of 4272 2304 lLObvSj.exe 146 PID 4272 wrote to memory of 384 4272 lLObvSj.exe 147 PID 384 wrote to memory of 3320 384 lLObvSj.exe 148 PID 3320 wrote to memory of 4044 3320 lLObvSj.exe 149 PID 4044 wrote to memory of 1104 4044 lLObvSj.exe 150 PID 1104 wrote to memory of 548 1104 lLObvSj.exe 151 PID 548 wrote to memory of 4884 548 lLObvSj.exe 152 PID 4884 wrote to memory of 2536 4884 lLObvSj.exe 153 PID 2536 wrote to memory of 2576 2536 lLObvSj.exe 154 PID 2576 wrote to memory of 2936 2576 lLObvSj.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe9⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe12⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe14⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe15⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe26⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe33⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe37⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe40⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe44⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe49⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe54⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe55⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe65⤵
- Executes dropped EXE
PID:2936 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe66⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe67⤵PID:4212
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe68⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe69⤵PID:4952
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe70⤵
- Drops file in System32 directory
PID:3364 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe71⤵PID:4356
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe72⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe73⤵PID:4004
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe74⤵PID:2996
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe75⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe76⤵PID:752
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe77⤵
- Drops file in System32 directory
PID:4488 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe78⤵PID:3268
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe79⤵PID:3224
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe80⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe81⤵
- Drops file in System32 directory
PID:3148 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe82⤵
- Drops file in System32 directory
PID:1556 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe83⤵PID:3012
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe84⤵PID:1720
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe85⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2372 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe86⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5096 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe87⤵PID:5044
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe88⤵PID:2832
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe89⤵PID:1684
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe90⤵PID:4708
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe91⤵
- Enumerates connected drives
PID:4396 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe92⤵PID:2468
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe93⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe94⤵PID:3360
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe95⤵
- Enumerates connected drives
PID:2244 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe96⤵
- Drops file in System32 directory
PID:1912 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe97⤵PID:5136
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe98⤵
- Enumerates connected drives
PID:5152 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe99⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe100⤵PID:5184
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe101⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe102⤵PID:5216
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe103⤵
- Drops file in System32 directory
PID:5232 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe104⤵PID:5248
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe105⤵PID:5264
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe106⤵PID:5280
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe107⤵PID:5296
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe108⤵PID:5312
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe109⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe110⤵PID:5344
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe111⤵PID:5360
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe112⤵
- Drops file in System32 directory
PID:5376 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe113⤵
- Enumerates connected drives
PID:5392 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe114⤵PID:5408
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe115⤵PID:5424
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe116⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe117⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5452 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe118⤵
- Enumerates connected drives
PID:5472 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe119⤵PID:5488
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe120⤵PID:5512
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe121⤵
- Enumerates connected drives
PID:5540 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe122⤵PID:5568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-