Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe
- Size 232KB
- Sample261002-leew4sshpc
- SHA256 3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c
- MD5 cec00acc7e14574d54d88f328745c740
- SHA1 dcc9dfbfbac901c8d543eec6dafdbac8cc077d4f
- SHA512 3d7767c337ae6e41f5095528585c5d28dee2cf4e695cb32b1e549e0322fd9457f717954fb63dae09fac5b2e0c3920099ea7f8cc73eb64070d583889e7538cd99
- SSDEEP 3072:C05vMnlurPPNJrf/Zy50Vgqq4+tiam3n/C8hmxOUUr3dtAiLF:C05hrPFJr3G0Vpr+tiaOhh4arDv
- TLSH T1593428BEBB02823AE111007C8D0A56B569563E342D2998EBF3D1FF1D24F51E76639387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6024 lLObvSj.exe 3400 lLObvSj.exe 3008 lLObvSj.exe 2716 lLObvSj.exe 5936 lLObvSj.exe 4980 lLObvSj.exe 464 lLObvSj.exe 4872 lLObvSj.exe 2608 lLObvSj.exe 3164 lLObvSj.exe 3048 lLObvSj.exe 4268 lLObvSj.exe 3396 lLObvSj.exe 1248 lLObvSj.exe 2136 lLObvSj.exe 4300 lLObvSj.exe 2524 lLObvSj.exe 3744 lLObvSj.exe 5708 lLObvSj.exe 6116 lLObvSj.exe 4904 lLObvSj.exe 3464 lLObvSj.exe 5100 lLObvSj.exe 960 lLObvSj.exe 5536 lLObvSj.exe 3240 lLObvSj.exe 6088 lLObvSj.exe 300 lLObvSj.exe 252 lLObvSj.exe 4284 lLObvSj.exe 2912 lLObvSj.exe 720 lLObvSj.exe 1536 lLObvSj.exe 804 lLObvSj.exe 4100 lLObvSj.exe 5988 lLObvSj.exe 3948 lLObvSj.exe 5280 lLObvSj.exe 2852 lLObvSj.exe 1520 lLObvSj.exe 1908 lLObvSj.exe 5032 lLObvSj.exe 5308 lLObvSj.exe 2388 lLObvSj.exe 5348 lLObvSj.exe 2768 lLObvSj.exe 5336 lLObvSj.exe 1084 lLObvSj.exe 3136 lLObvSj.exe 3700 lLObvSj.exe 2072 lLObvSj.exe 4232 lLObvSj.exe 1596 lLObvSj.exe 1948 lLObvSj.exe 3448 lLObvSj.exe 5684 lLObvSj.exe 3336 lLObvSj.exe 5908 lLObvSj.exe 4444 lLObvSj.exe 4424 lLObvSj.exe 6084 lLObvSj.exe 3556 lLObvSj.exe 3232 lLObvSj.exe 692 lLObvSj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\r: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\r: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\s: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe File opened (read-only) \??\x: lLObvSj.exe File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\h: lLObvSj.exe File opened (read-only) \??\k: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\p: lLObvSj.exe File opened (read-only) \??\w: lLObvSj.exe File opened (read-only) \??\j: lLObvSj.exe File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\q: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\t: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\q: lLObvSj.exe File opened (read-only) \??\z: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\i: lLObvSj.exe File opened (read-only) \??\s: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\d: lLObvSj.exe File opened (read-only) \??\x: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\v: lLObvSj.exe File opened (read-only) \??\o: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\y: lLObvSj.exe File opened (read-only) \??\u: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe File opened (read-only) \??\l: lLObvSj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe File created C:\Windows\SysWOW64\lLObvSj\uDIMRQz.exe lLObvSj.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lLObvSj.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 5656 jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe Token: SeLoadDriverPrivilege 6024 lLObvSj.exe Token: SeLoadDriverPrivilege 3400 lLObvSj.exe Token: SeLoadDriverPrivilege 3008 lLObvSj.exe Token: SeLoadDriverPrivilege 2716 lLObvSj.exe Token: SeLoadDriverPrivilege 5936 lLObvSj.exe Token: SeLoadDriverPrivilege 4980 lLObvSj.exe Token: SeLoadDriverPrivilege 464 lLObvSj.exe Token: SeLoadDriverPrivilege 4872 lLObvSj.exe Token: SeLoadDriverPrivilege 2608 lLObvSj.exe Token: SeLoadDriverPrivilege 3164 lLObvSj.exe Token: SeLoadDriverPrivilege 3048 lLObvSj.exe Token: SeLoadDriverPrivilege 4268 lLObvSj.exe Token: SeLoadDriverPrivilege 3396 lLObvSj.exe Token: SeLoadDriverPrivilege 1248 lLObvSj.exe Token: SeLoadDriverPrivilege 2136 lLObvSj.exe Token: SeLoadDriverPrivilege 4300 lLObvSj.exe Token: SeLoadDriverPrivilege 2524 lLObvSj.exe Token: SeLoadDriverPrivilege 3744 lLObvSj.exe Token: SeLoadDriverPrivilege 5708 lLObvSj.exe Token: SeLoadDriverPrivilege 6116 lLObvSj.exe Token: SeLoadDriverPrivilege 4904 lLObvSj.exe Token: SeLoadDriverPrivilege 3464 lLObvSj.exe Token: SeLoadDriverPrivilege 5100 lLObvSj.exe Token: SeLoadDriverPrivilege 960 lLObvSj.exe Token: SeLoadDriverPrivilege 5536 lLObvSj.exe Token: SeLoadDriverPrivilege 3240 lLObvSj.exe Token: SeLoadDriverPrivilege 6088 lLObvSj.exe Token: SeLoadDriverPrivilege 300 lLObvSj.exe Token: SeLoadDriverPrivilege 252 lLObvSj.exe Token: SeLoadDriverPrivilege 4284 lLObvSj.exe Token: SeLoadDriverPrivilege 2912 lLObvSj.exe Token: SeLoadDriverPrivilege 720 lLObvSj.exe Token: SeLoadDriverPrivilege 1536 lLObvSj.exe Token: SeLoadDriverPrivilege 804 lLObvSj.exe Token: SeLoadDriverPrivilege 4100 lLObvSj.exe Token: SeLoadDriverPrivilege 5988 lLObvSj.exe Token: SeLoadDriverPrivilege 3948 lLObvSj.exe Token: SeLoadDriverPrivilege 5280 lLObvSj.exe Token: SeLoadDriverPrivilege 2852 lLObvSj.exe Token: SeLoadDriverPrivilege 1520 lLObvSj.exe Token: SeLoadDriverPrivilege 1908 lLObvSj.exe Token: SeLoadDriverPrivilege 5032 lLObvSj.exe Token: SeLoadDriverPrivilege 5308 lLObvSj.exe Token: SeLoadDriverPrivilege 2388 lLObvSj.exe Token: SeLoadDriverPrivilege 5348 lLObvSj.exe Token: SeLoadDriverPrivilege 2768 lLObvSj.exe Token: SeLoadDriverPrivilege 5336 lLObvSj.exe Token: SeLoadDriverPrivilege 1084 lLObvSj.exe Token: SeLoadDriverPrivilege 3136 lLObvSj.exe Token: SeLoadDriverPrivilege 3700 lLObvSj.exe Token: SeLoadDriverPrivilege 2072 lLObvSj.exe Token: SeLoadDriverPrivilege 4232 lLObvSj.exe Token: SeLoadDriverPrivilege 1596 lLObvSj.exe Token: SeLoadDriverPrivilege 1948 lLObvSj.exe Token: SeLoadDriverPrivilege 3448 lLObvSj.exe Token: SeLoadDriverPrivilege 5684 lLObvSj.exe Token: SeLoadDriverPrivilege 3336 lLObvSj.exe Token: SeLoadDriverPrivilege 5908 lLObvSj.exe Token: SeLoadDriverPrivilege 4444 lLObvSj.exe Token: SeLoadDriverPrivilege 4424 lLObvSj.exe Token: SeLoadDriverPrivilege 6084 lLObvSj.exe Token: SeLoadDriverPrivilege 3556 lLObvSj.exe Token: SeLoadDriverPrivilege 3232 lLObvSj.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5656 wrote to memory of 6024 5656 jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe 89 PID 6024 wrote to memory of 3400 6024 lLObvSj.exe 90 PID 3400 wrote to memory of 3008 3400 lLObvSj.exe 91 PID 3008 wrote to memory of 2716 3008 lLObvSj.exe 92 PID 2716 wrote to memory of 5936 2716 lLObvSj.exe 93 PID 5936 wrote to memory of 4980 5936 lLObvSj.exe 94 PID 4980 wrote to memory of 464 4980 lLObvSj.exe 95 PID 464 wrote to memory of 4872 464 lLObvSj.exe 96 PID 4872 wrote to memory of 2608 4872 lLObvSj.exe 97 PID 2608 wrote to memory of 3164 2608 lLObvSj.exe 98 PID 3164 wrote to memory of 3048 3164 lLObvSj.exe 99 PID 3048 wrote to memory of 4268 3048 lLObvSj.exe 100 PID 4268 wrote to memory of 3396 4268 lLObvSj.exe 101 PID 3396 wrote to memory of 1248 3396 lLObvSj.exe 102 PID 1248 wrote to memory of 2136 1248 lLObvSj.exe 103 PID 2136 wrote to memory of 4300 2136 lLObvSj.exe 104 PID 4300 wrote to memory of 2524 4300 lLObvSj.exe 105 PID 2524 wrote to memory of 3744 2524 lLObvSj.exe 106 PID 3744 wrote to memory of 5708 3744 lLObvSj.exe 107 PID 5708 wrote to memory of 6116 5708 lLObvSj.exe 108 PID 6116 wrote to memory of 4904 6116 lLObvSj.exe 109 PID 4904 wrote to memory of 3464 4904 lLObvSj.exe 110 PID 3464 wrote to memory of 5100 3464 lLObvSj.exe 111 PID 5100 wrote to memory of 960 5100 lLObvSj.exe 112 PID 960 wrote to memory of 5536 960 lLObvSj.exe 113 PID 5536 wrote to memory of 3240 5536 lLObvSj.exe 114 PID 3240 wrote to memory of 6088 3240 lLObvSj.exe 115 PID 6088 wrote to memory of 300 6088 lLObvSj.exe 116 PID 300 wrote to memory of 252 300 lLObvSj.exe 117 PID 252 wrote to memory of 4284 252 lLObvSj.exe 118 PID 4284 wrote to memory of 2912 4284 lLObvSj.exe 119 PID 2912 wrote to memory of 720 2912 lLObvSj.exe 120 PID 720 wrote to memory of 1536 720 lLObvSj.exe 121 PID 1536 wrote to memory of 804 1536 lLObvSj.exe 122 PID 804 wrote to memory of 4100 804 lLObvSj.exe 123 PID 4100 wrote to memory of 5988 4100 lLObvSj.exe 124 PID 5988 wrote to memory of 3948 5988 lLObvSj.exe 125 PID 3948 wrote to memory of 5280 3948 lLObvSj.exe 126 PID 5280 wrote to memory of 2852 5280 lLObvSj.exe 127 PID 2852 wrote to memory of 1520 2852 lLObvSj.exe 128 PID 1520 wrote to memory of 1908 1520 lLObvSj.exe 129 PID 1908 wrote to memory of 5032 1908 lLObvSj.exe 130 PID 5032 wrote to memory of 5308 5032 lLObvSj.exe 131 PID 5308 wrote to memory of 2388 5308 lLObvSj.exe 132 PID 2388 wrote to memory of 5348 2388 lLObvSj.exe 133 PID 5348 wrote to memory of 2768 5348 lLObvSj.exe 134 PID 2768 wrote to memory of 5336 2768 lLObvSj.exe 135 PID 5336 wrote to memory of 1084 5336 lLObvSj.exe 136 PID 1084 wrote to memory of 3136 1084 lLObvSj.exe 137 PID 3136 wrote to memory of 3700 3136 lLObvSj.exe 138 PID 3700 wrote to memory of 2072 3700 lLObvSj.exe 139 PID 2072 wrote to memory of 4232 2072 lLObvSj.exe 140 PID 4232 wrote to memory of 1596 4232 lLObvSj.exe 141 PID 1596 wrote to memory of 1948 1596 lLObvSj.exe 142 PID 1948 wrote to memory of 3448 1948 lLObvSj.exe 143 PID 3448 wrote to memory of 5684 3448 lLObvSj.exe 144 PID 5684 wrote to memory of 3336 5684 lLObvSj.exe 145 PID 3336 wrote to memory of 5908 3336 lLObvSj.exe 146 PID 5908 wrote to memory of 4444 5908 lLObvSj.exe 147 PID 4444 wrote to memory of 4424 4444 lLObvSj.exe 148 PID 4424 wrote to memory of 6084 4424 lLObvSj.exe 149 PID 6084 wrote to memory of 3556 6084 lLObvSj.exe 150 PID 3556 wrote to memory of 3232 3556 lLObvSj.exe 151 PID 3232 wrote to memory of 692 3232 lLObvSj.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b1bb95e9199c045fd1d0e360e264a4da604c11123fa281d7b184d7cb9d5185c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe11⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe18⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe19⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe22⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe28⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe36⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe45⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe52⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe57⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe58⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe59⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe61⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe63⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe65⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe66⤵
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe67⤵
- Enumerates connected drives
PID:5172 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe68⤵
- Drops file in System32 directory
PID:5736 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe69⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe70⤵
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe71⤵PID:1660
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe72⤵
- Enumerates connected drives
PID:832 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe73⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe74⤵
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe75⤵
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe76⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe77⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe78⤵PID:2604
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe79⤵PID:2528
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe80⤵PID:2580
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe81⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5396 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe82⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3800 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe83⤵PID:3192
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe84⤵
- Enumerates connected drives
PID:2692 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe85⤵
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe86⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe87⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe88⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe89⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3504 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe90⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe91⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe92⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe93⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:4168 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe94⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe95⤵
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe96⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:1888 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe97⤵
- Enumerates connected drives
PID:3548 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe98⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:3368 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe99⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe100⤵
- Enumerates connected drives
PID:4360 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe101⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:2628 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe102⤵
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe103⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:3472 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe104⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe105⤵PID:2256
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe106⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe107⤵PID:1416
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe108⤵
- System Location Discovery: System Language Discovery
PID:704 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe109⤵PID:4476
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe110⤵PID:4844
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe111⤵
- System Location Discovery: System Language Discovery
PID:5456 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe112⤵
- Enumerates connected drives
PID:4456 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe113⤵
- Enumerates connected drives
- Drops file in System32 directory
PID:5576 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe114⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe115⤵PID:1128
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe116⤵PID:2556
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe117⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe118⤵
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe119⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe120⤵PID:5848
-
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5436 -
C:\Windows\SysWOW64\uDIMRQz\lLObvSj.exeC:\Windows\system32\uDIMRQz\lLObvSj.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-