Malware Analysis Report

2025-03-14 23:06

Sample ID 240406-3w7f5afd38
Target e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118
SHA256 1216e035172ca439a382d71c6965f5eb5b657fa19beb0b2360511772a6223740
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1216e035172ca439a382d71c6965f5eb5b657fa19beb0b2360511772a6223740

Threat Level: Known bad

The file e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Windows security bypass

Disables RegEdit via registry modification

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Windows security modification

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

Drops file in System32 directory

AutoIT Executable

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Modifies registry class

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 23:52

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 23:52

Reported

2024-04-06 23:55

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcjmjomz = "ofikbnaxoe.exe" C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ljnhbphi = "bknzacridzbtmyi.exe" C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wjpevirtwwpcc.exe" C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\p: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\tjgumptj.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\wjpevirtwwpcc.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wjpevirtwwpcc.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created C:\Windows\SysWOW64\bknzacridzbtmyi.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bknzacridzbtmyi.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\tjgumptj.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tjgumptj.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ofikbnaxoe.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ofikbnaxoe.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\tjgumptj.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\tjgumptj.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACEFABFF963F293830E3B4281993998B08B03FE4311023DE1BA45E908A3" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFF8D4F5B856D9045D72E7E97BC90E635584066476346D7EE" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC67B15ECDAB3B8BD7FE4ED9634B9" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372C7E9C2083546A3E76A570272DD67D8164DC" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F66BB6FE6E21ACD27AD0A18A749060" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B1204790389853BAB9D233EAD7CC" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\ofikbnaxoe.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\ofikbnaxoe.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\tjgumptj.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\wjpevirtwwpcc.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A
N/A N/A C:\Windows\SysWOW64\bknzacridzbtmyi.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5044 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ofikbnaxoe.exe
PID 5044 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ofikbnaxoe.exe
PID 5044 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ofikbnaxoe.exe
PID 5044 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\bknzacridzbtmyi.exe
PID 5044 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\bknzacridzbtmyi.exe
PID 5044 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\bknzacridzbtmyi.exe
PID 5044 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 5044 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 5044 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 5044 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\wjpevirtwwpcc.exe
PID 5044 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\wjpevirtwwpcc.exe
PID 5044 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\wjpevirtwwpcc.exe
PID 3124 wrote to memory of 4868 N/A C:\Windows\SysWOW64\ofikbnaxoe.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 3124 wrote to memory of 4868 N/A C:\Windows\SysWOW64\ofikbnaxoe.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 3124 wrote to memory of 4868 N/A C:\Windows\SysWOW64\ofikbnaxoe.exe C:\Windows\SysWOW64\tjgumptj.exe
PID 5044 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 5044 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe"

C:\Windows\SysWOW64\ofikbnaxoe.exe

ofikbnaxoe.exe

C:\Windows\SysWOW64\bknzacridzbtmyi.exe

bknzacridzbtmyi.exe

C:\Windows\SysWOW64\tjgumptj.exe

tjgumptj.exe

C:\Windows\SysWOW64\wjpevirtwwpcc.exe

wjpevirtwwpcc.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\tjgumptj.exe

C:\Windows\system32\tjgumptj.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 21.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/5044-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\bknzacridzbtmyi.exe

MD5 cf52f5321df013a1e8a74c27fd873150
SHA1 860a2758d0134907eb40e6c4baa6ec7bc87c83c6
SHA256 27b4fe56e0e0d4ddd46ff85016baa8c406e0621fc90201ab4e919b0bbb6b4972
SHA512 4edbae417d1decca70a9b2f6a0f1ff08396782002a7efb1af8b9ecd196ae9eb030adb8bd8a9f49ea01127331f34a12db4cf510405e9af5f0617564196193d2ff

C:\Windows\SysWOW64\ofikbnaxoe.exe

MD5 1f2e114252f288eeeb520bc3e5ee2934
SHA1 bf809107fb9f190978dd5b7877307fd4b194b5e2
SHA256 18125d9cd1e793a84439267743a0d9287bce01801f561d5bd1cb3a1dea478155
SHA512 90696f0d67e4875094b0117f5cb7ca369931487fd0a587ccae710124d8f6e98b39372c5d1b662007f6efa6cd9d1eb107cdb085033cc9396245157902669d8f92

C:\Windows\SysWOW64\tjgumptj.exe

MD5 ece1f706805cc0cb739cc42706a57a0e
SHA1 2d372eba8f20acdb858f7f324cccbf62c2f052ec
SHA256 867c7bfd7108f2cbebbb78a45f98ef17389beef2491cf9924185d6ffb4fd42d8
SHA512 713e52d64e0ad6cc04ea46f84f269bdc7d535c81c0dee5932fcda70569b3ddbfbe91ab54b98bf4785f63d73dee202a90c0d9a8e992d095c0a44c86f0a6da48f4

C:\Windows\SysWOW64\wjpevirtwwpcc.exe

MD5 55f8c5ad90b692f55858e89358b8abfb
SHA1 d6db91fb4f8174ba150194464dce81ef275e41b6
SHA256 2745869db661b506cf57e4bdb490a03da6b8accc46e398b3f7c4621e32a3797b
SHA512 86ffba7c2594f81917b83b7b3285f42c88a8b1ee1ac381177278658a30e9675be1773353c6fc638d809ab34587b2f2443e094f1615982312f5df2868019843be

memory/1152-37-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-38-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-39-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-41-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-40-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-42-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-43-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-45-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-44-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-46-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-47-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-48-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-49-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-50-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-51-0x00007FF825250000-0x00007FF825260000-memory.dmp

memory/1152-52-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-53-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-54-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-55-0x00007FF825250000-0x00007FF825260000-memory.dmp

memory/1152-56-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-57-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 dd3a442eac18e977cb516e07ac844b0f
SHA1 6e20f286087230114db861e4bae4e02a6ccf7bf7
SHA256 73cd76ff84d752a6e670a2d2f5994af66c970cdda6243442f8f5c29dc15e212b
SHA512 7feb0863552957dfe50175ae21c5e74e3846687e500b4bc2c83926d6bb632e460067b61c7b6429d3f8541f76a1f7d8c3fde5087831a2e4632ef4ba0fc7feedb1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 6a958c8e1e3d4c1e7f2d0cad6f0c17f3
SHA1 50cbf4455330da3b60c45454933e2a327d919528
SHA256 ce55aa5846882ec513d1df1a43e3e821d3f2126fdcdf443f1cacfadfedad2d11
SHA512 c943ea49e261022638b07d405ff152745e2294228e9193b44c2c9fb70d255ba3cb4bed2e4dc815cd0eaa2eaee325053e93edb8319255376aaf138923490b2ddb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 5f022588c89b9ae32c864cc214f6c8b7
SHA1 3ab5e23cf7eac5fa68eb4266a721ac7f0e856e12
SHA256 f8a89d9d4af92caed43ebefc17ee73dc6c2686f4bc9da99b19502429e8f6c80d
SHA512 c43631b915f9020700b3758b82baba0bb5dd10e0d9ae21ce195e8c43ad218ac8570caa905e8b995afeab3e0ca3b70ad397bb1391787ce08ee4ac1465d12f91db

memory/1152-105-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 72a0ee85f20eed1f184130250fcb1172
SHA1 89256fb53ad9393e60551181f62338021ec20c76
SHA256 1e0cc82dd4b581a82ae3050d3a1ab707df759ddf37be4ada8ed11b1efccb93e4
SHA512 8b64345cc29103893ab1b2d8c0256e5aa80bd353bad8d8e6fc50010f5389bbf12696f71cd36b8691ca0d975210b6403a15d76917624449419636fc65bbd69ea6

memory/1152-136-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-137-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-138-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-139-0x00007FF827A70000-0x00007FF827A80000-memory.dmp

memory/1152-140-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-142-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

memory/1152-141-0x00007FF8679F0000-0x00007FF867BE5000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 23:52

Reported

2024-04-06 23:55

Platform

win7-20240319-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ffoyphrync.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ffoyphrync.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewehldgt = "ffoyphrync.exe" C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atloqsuk = "lpexguvwinhpzss.exe" C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "yjhccqqeozvlk.exe" C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\x: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ffoyphrync.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hwxncqta.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ffoyphrync.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\hwxncqta.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\yjhccqqeozvlk.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hwxncqta.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\yjhccqqeozvlk.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ffoyphrync.exe N/A
File created C:\Windows\SysWOW64\ffoyphrync.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ffoyphrync.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hwxncqta.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hwxncqta.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwxncqta.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452C7E9C2682566D4576A777242DD77D8064DA" C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\ffoyphrync.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ffoyphrync.exe N/A
N/A N/A C:\Windows\SysWOW64\ffoyphrync.exe N/A
N/A N/A C:\Windows\SysWOW64\ffoyphrync.exe N/A
N/A N/A C:\Windows\SysWOW64\ffoyphrync.exe N/A
N/A N/A C:\Windows\SysWOW64\ffoyphrync.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\hwxncqta.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A
N/A N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe N/A
N/A N/A C:\Windows\SysWOW64\yjhccqqeozvlk.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ffoyphrync.exe
PID 2200 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ffoyphrync.exe
PID 2200 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ffoyphrync.exe
PID 2200 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\ffoyphrync.exe
PID 2200 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\lpexguvwinhpzss.exe
PID 2200 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\lpexguvwinhpzss.exe
PID 2200 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\lpexguvwinhpzss.exe
PID 2200 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\lpexguvwinhpzss.exe
PID 2200 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 2200 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 2200 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 2200 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 2592 wrote to memory of 2560 N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2560 N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2560 N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2560 N/A C:\Windows\SysWOW64\lpexguvwinhpzss.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2200 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2200 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2200 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2560 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2560 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2560 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 2560 wrote to memory of 2536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\yjhccqqeozvlk.exe
PID 1720 wrote to memory of 2412 N/A C:\Windows\SysWOW64\ffoyphrync.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 1720 wrote to memory of 2412 N/A C:\Windows\SysWOW64\ffoyphrync.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 1720 wrote to memory of 2412 N/A C:\Windows\SysWOW64\ffoyphrync.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 1720 wrote to memory of 2412 N/A C:\Windows\SysWOW64\ffoyphrync.exe C:\Windows\SysWOW64\hwxncqta.exe
PID 2200 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2200 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2200 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2200 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2532 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e3957b982a6b005595fa10384cc6bb4f_JaffaCakes118.exe"

C:\Windows\SysWOW64\ffoyphrync.exe

ffoyphrync.exe

C:\Windows\SysWOW64\lpexguvwinhpzss.exe

lpexguvwinhpzss.exe

C:\Windows\SysWOW64\hwxncqta.exe

hwxncqta.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c yjhccqqeozvlk.exe

C:\Windows\SysWOW64\yjhccqqeozvlk.exe

yjhccqqeozvlk.exe

C:\Windows\SysWOW64\yjhccqqeozvlk.exe

yjhccqqeozvlk.exe

C:\Windows\SysWOW64\hwxncqta.exe

C:\Windows\system32\hwxncqta.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2200-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\lpexguvwinhpzss.exe

MD5 7e736af4a56ef93cf9d33efa6d28df39
SHA1 a6a37067c4303049a866418547be3b607bcda4b9
SHA256 b0122cd1535d4b0de565b4bf14faf080522fdb850a5d96a8306e73110e2b9773
SHA512 3e20a8f710111da505949ae57460e2c8576ccac9b32b1a7d3636c264539f1ad26ddd0c9abf7264c3f8ecca370078cc004577c61f05c25f78acb4cb74b77687e6

\Windows\SysWOW64\ffoyphrync.exe

MD5 83f99aafb74b38de02dc09fa1613c0b8
SHA1 4367c5f6f004cf4f56f6b56a0cf4f6979035d63a
SHA256 fbda3f79c1615efd0acbb2aeacc35a370eb25abe0c22f27b01b231d802bf183d
SHA512 4e2de6f2043034a03696a058fdc6d371218944facd28ba35ac14fc608ae3c036024c99a8783dfdc346464b9615fee1646d7b1b9aefaab7c56f2e27cdd21e8a0b

\Windows\SysWOW64\yjhccqqeozvlk.exe

MD5 e94fe378223cdcb3b5c6f0f689cfb61c
SHA1 4309d05f95e37350d0fa4099d4254fe2809f029d
SHA256 e1a45a43ff6709e2e7a9f81e765a0f2631cd3863c6c678f96e174c638161e454
SHA512 4a0529f3d97b6023601af0987fbd3ab3ff4dc24bc5bbc86d80b7e0552a01dab648a3f31741090c9e31d6f8434f010c1412456d37aa9f2f7b59e607bc9582c6b1

\Windows\SysWOW64\hwxncqta.exe

MD5 bed6dd05f1048b43479cf516712e4b40
SHA1 08eec4bea3faa6f8282efa1c503d5423f82d3ef0
SHA256 3eae6f198f22c87d108359d1c0e07a0e923e107700d50359debed58fa270f16e
SHA512 306c6e30d81d5826760e3b964bf904f4a644962739c9fdaccd0c0b9992aeb3425d71072c54f4ff30bdbe9c369cd391431d108246d7ef4a4faee126fc6c104441

memory/2532-48-0x000000002F641000-0x000000002F642000-memory.dmp

memory/2532-49-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2532-50-0x0000000070B6D000-0x0000000070B78000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 776aa264b89d7ad081aa4b7f725cde32
SHA1 27ca5e8e8c117512c805d8bab9959c281d7b1e77
SHA256 791c79a516dcb88729f81528acccaa00db4061de9e0d17332fd3d99a819b2c1a
SHA512 99c3202757cab0c00f9be1fbe246437a14014ed7d8b84c8f9d9625c49a47dfa87e5b43bfb0cd4c7c034dd081535ef0dbc2e8b499bcf6bcb9753d9525e7252934

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 7c5c8435ac1341c6bb7c05e0c5f09a08
SHA1 f41c9aa3928b991fb7f7bc4ba1c2742c53c9bf53
SHA256 957a035800d5e5bbc85bc6d6ff79847db7b166babfa34babc08eebbfb57a68db
SHA512 05f6649cfb1f3783e48252c4a267624b330f84c91d53c0aa630440b3a153f0bfcb13a9c283a0a892fa0372f947d1e1efa959948ac56b515cac85ec86498ca665

C:\Users\Admin\Documents\DismountSync.doc.exe

MD5 c4fd49525922ccf6cd7851349b9fbf67
SHA1 019e9e983d7a53ba7d849b8ed948c06c08051e60
SHA256 5d53c40abbe4c8da8b43527caed0b466fdd1ae0e5937e5da66a3ec9523af9d17
SHA512 f91ed8657c5f972e4ddbae01288e374d1073429d9b59603506d415c57bbc3caec7c0b6d8e26f48423eee8178f379ac303177ba4c0b0ff727896544cfecb6c52d

memory/2532-93-0x0000000070B6D000-0x0000000070B78000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 25d2479fdbf82728fdc8ba92bb65a115
SHA1 9cbf59a5d4add1f073ff0811eaf38848174ead7b
SHA256 247a82fb137d31321dd8f9713a6795d04cef64c334429a3a7ae2b441fc359e0d
SHA512 77a4c352f7e6119a5d7125777dcd58cc7b2457ceb118c5bfc856dbc3e10a7896d4e9f2f94d1c7df757b23c857bfd3e7f21c8ae315a415197463120093fd3abc6

memory/2532-114-0x000000005FFF0000-0x0000000060000000-memory.dmp