Malware Analysis Report

2024-11-13 13:58

Sample ID 240407-y2zk9add6t
Target e5c5edde770bc5b229112f11f43f5019_JaffaCakes118
SHA256 42bfaa077ffeb81706e21042ac4f55b206b9409be8f0c907b1d34e256652f080
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42bfaa077ffeb81706e21042ac4f55b206b9409be8f0c907b1d34e256652f080

Threat Level: Known bad

The file e5c5edde770bc5b229112f11f43f5019_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Windows security modification

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

AutoIT Executable

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 20:17

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 20:17

Reported

2024-04-07 20:20

Platform

win7-20240221-en

Max time kernel

154s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\uycmgagtlh.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\uycmgagtlh.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\hoxhqqot.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ucsbjfwwmwipd.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\uycmgagtlh.exe N/A
File created C:\Windows\SysWOW64\jbclzoujlwqpavc.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\jbclzoujlwqpavc.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hoxhqqot.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ucsbjfwwmwipd.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\uycmgagtlh.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\uycmgagtlh.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hoxhqqot.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hoxhqqot.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hoxhqqot.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC60F15E4DAC3B8BA7F97EDE734C6" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462D089C5183526A4476D170212DDA7D8264A8" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF4FFFF4F5A85139132D7217E92BC95E1445840674E623ED790" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0866BB0FF6E21ABD27CD0A48B0E9162" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\uycmgagtlh.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\uycmgagtlh.exe N/A
N/A N/A C:\Windows\SysWOW64\uycmgagtlh.exe N/A
N/A N/A C:\Windows\SysWOW64\uycmgagtlh.exe N/A
N/A N/A C:\Windows\SysWOW64\uycmgagtlh.exe N/A
N/A N/A C:\Windows\SysWOW64\uycmgagtlh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\hoxhqqot.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A
N/A N/A C:\Windows\SysWOW64\ucsbjfwwmwipd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uycmgagtlh.exe
PID 2272 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uycmgagtlh.exe
PID 2272 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uycmgagtlh.exe
PID 2272 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uycmgagtlh.exe
PID 2272 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\jbclzoujlwqpavc.exe
PID 2272 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\jbclzoujlwqpavc.exe
PID 2272 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\jbclzoujlwqpavc.exe
PID 2272 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\jbclzoujlwqpavc.exe
PID 2272 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 2272 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 2272 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 2272 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 2272 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ucsbjfwwmwipd.exe
PID 2272 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ucsbjfwwmwipd.exe
PID 2272 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ucsbjfwwmwipd.exe
PID 2272 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ucsbjfwwmwipd.exe
PID 1916 wrote to memory of 2488 N/A C:\Windows\SysWOW64\uycmgagtlh.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 1916 wrote to memory of 2488 N/A C:\Windows\SysWOW64\uycmgagtlh.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 1916 wrote to memory of 2488 N/A C:\Windows\SysWOW64\uycmgagtlh.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 1916 wrote to memory of 2488 N/A C:\Windows\SysWOW64\uycmgagtlh.exe C:\Windows\SysWOW64\hoxhqqot.exe
PID 2272 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2272 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2272 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2272 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2588 wrote to memory of 580 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2588 wrote to memory of 580 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2588 wrote to memory of 580 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2588 wrote to memory of 580 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe"

C:\Windows\SysWOW64\uycmgagtlh.exe

uycmgagtlh.exe

C:\Windows\SysWOW64\jbclzoujlwqpavc.exe

jbclzoujlwqpavc.exe

C:\Windows\SysWOW64\hoxhqqot.exe

hoxhqqot.exe

C:\Windows\SysWOW64\ucsbjfwwmwipd.exe

ucsbjfwwmwipd.exe

C:\Windows\SysWOW64\hoxhqqot.exe

C:\Windows\system32\hoxhqqot.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2272-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\jbclzoujlwqpavc.exe

MD5 5af54055a4a6f2b04c977917e2f6ce28
SHA1 b14582448e4bc274b12dbe2fe848ec7d75f7d320
SHA256 daaab1d096287790a51925475b5fa885d4fb9119ff7ef7f2564242e08ec33bb6
SHA512 356222f49c698452cc0c5c3da13fad54828b401b1d9f899f17d191f01fb83845f9804896de33df8d4eb194929d20335c046300281bdcea291642b3324881a9ae

\Windows\SysWOW64\uycmgagtlh.exe

MD5 c26ae97963bd2a22bd027cb77b55a4d8
SHA1 dcc2f68e0cc93eaba7a06b598779f329009cf510
SHA256 cd5d1b0881591fc388e138067d613cec7fc19fec283d53814327530731f542f1
SHA512 599dddb510216fd5d680eab104c9688bdd960227e607a341c109e38aee89bfbca81d4fd83f4297648485f04e3866580a9c6c33b9f841fd57cae23b59c013187c

\Windows\SysWOW64\hoxhqqot.exe

MD5 ce009da4b5c2663bea0ba8a6c521e854
SHA1 35756e7b084b48b77172c7a77c64e18e467ee14a
SHA256 44cf0569fe956800d50fdecdce7979d4561caf63c4ddf5889b70a170563990be
SHA512 e03aa73b09a6abf41205d28724c679f83a677c4310795e101d1b4125fe87d8183079073f4173fa787e80f69a7291638946f1b920f1392128569b0b638bf8f826

\Windows\SysWOW64\ucsbjfwwmwipd.exe

MD5 2dc8651d25c96a6b27d2965292a43708
SHA1 fa57366476686b16856a504e3501ba69424b4c02
SHA256 273f9a2e35f6a121ec3f4781a2fc412500e74405eb0e5acfc624780170e9c07c
SHA512 83296e07495785cd2cbcb1731a88ad1ea903cbd192e7c46211b0960fa14ebd09eafb99d6294b7ba6ee09d5cf6d08db2879ddfc252b56e37c5be0eec091cda30d

memory/2588-44-0x000000002F911000-0x000000002F912000-memory.dmp

memory/2588-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2588-46-0x000000007152D000-0x0000000071538000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\Documents\UseMerge.doc.exe

MD5 f097d4c13df4cf9277c737ac6448e1ee
SHA1 ac206ca9a5ef59c34afa5bda3a56f61ec1039858
SHA256 856de1931be205053b01f4187a667e742616c38d925c7948c518c71d5a599501
SHA512 dc45c1986b84422dd4dd827b6bf9f7d7e10e273e9df76a28217f981961fa142cd1f7668331d652c3ac0076e5cf77d248844bfa4a8df65140aaefd4cec0844175

memory/2588-83-0x000000007152D000-0x0000000071538000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 1d4526696f3c654324c2f13414d31ab6
SHA1 9052785a3d414456db6d57155d2940cb12bbee38
SHA256 318b3d52e668a78d122ae095bea6fd374fb6457e965d718560d38fb5ad5ae8fe
SHA512 1ce137e1c41b0c4b8fdf993886eb4392215d98af3cd97d202f6dafde5053d0ef3a3ebb0ca7de29e7c2c586052b37d4043d9e86c9bd1bd2e7c367d869f158ec5a

memory/2588-104-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 20:17

Reported

2024-04-07 20:20

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bmupxxxj = "wpijilmnxq.exe" C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wxlakjtz = "uvtkocelygoyxfs.exe" C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ihxtsmgulyllt.exe" C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\n: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\czkawrrg.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\wpijilmnxq.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\wpijilmnxq.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created C:\Windows\SysWOW64\wpijilmnxq.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ihxtsmgulyllt.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Windows\SysWOW64\wpijilmnxq.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\czkawrrg.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\czkawrrg.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\uvtkocelygoyxfs.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\uvtkocelygoyxfs.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ihxtsmgulyllt.exe C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\czkawrrg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\czkawrrg.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442D789C2083556A3576DC70542CA97C8665D8" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02047E539E352C9B9D033E8D7BE" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F36BB8FF1822D8D178D1A68B0E9160" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC7791597DAC5B8CF7C97ECE537BC" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\wpijilmnxq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFF9C9FE10F192837F3B42869E39E4B3FD02884367024BE2BD42E609A9" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FF8F4F28826E9042D72A7D92BC93E147583767346332D690" C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\wpijilmnxq.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\ihxtsmgulyllt.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\uvtkocelygoyxfs.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A
N/A N/A C:\Windows\SysWOW64\czkawrrg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\wpijilmnxq.exe
PID 2188 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\wpijilmnxq.exe
PID 2188 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\wpijilmnxq.exe
PID 2188 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uvtkocelygoyxfs.exe
PID 2188 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uvtkocelygoyxfs.exe
PID 2188 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\uvtkocelygoyxfs.exe
PID 2188 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\czkawrrg.exe
PID 2188 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\czkawrrg.exe
PID 2188 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\czkawrrg.exe
PID 2188 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ihxtsmgulyllt.exe
PID 2188 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ihxtsmgulyllt.exe
PID 2188 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Windows\SysWOW64\ihxtsmgulyllt.exe
PID 2188 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 2188 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 2236 wrote to memory of 4404 N/A C:\Windows\SysWOW64\wpijilmnxq.exe C:\Windows\SysWOW64\czkawrrg.exe
PID 2236 wrote to memory of 4404 N/A C:\Windows\SysWOW64\wpijilmnxq.exe C:\Windows\SysWOW64\czkawrrg.exe
PID 2236 wrote to memory of 4404 N/A C:\Windows\SysWOW64\wpijilmnxq.exe C:\Windows\SysWOW64\czkawrrg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e5c5edde770bc5b229112f11f43f5019_JaffaCakes118.exe"

C:\Windows\SysWOW64\wpijilmnxq.exe

wpijilmnxq.exe

C:\Windows\SysWOW64\uvtkocelygoyxfs.exe

uvtkocelygoyxfs.exe

C:\Windows\SysWOW64\czkawrrg.exe

czkawrrg.exe

C:\Windows\SysWOW64\ihxtsmgulyllt.exe

ihxtsmgulyllt.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\czkawrrg.exe

C:\Windows\system32\czkawrrg.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 172.217.18.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 10.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2188-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\uvtkocelygoyxfs.exe

MD5 c73d623ecbcb297479cdbc36e550c4da
SHA1 f7e8c2ceef4a60f93ef1f4f604a0169c2eb1c96c
SHA256 a45485c669a8f4a188ce1c43d000391951e194661cd22382973c6db53992bf1a
SHA512 9a7c94bdb9fb0d12352d58f6caf46177bdca4358f24ee76f4079d5c52d875f6d0364adc365abb786379eb355a646d365634cb135efc3a309add33e3a295ef850

C:\Windows\SysWOW64\wpijilmnxq.exe

MD5 bed43b3ba39ab4ececacd0596a539dbf
SHA1 c585860da282221f39c402b5bfdf792a1023dcc7
SHA256 52983964ddde2753b6c27e03baba179618022410485cb0deb64e54aa543da945
SHA512 289b419f817c16cad4e8d6a65a1c6b2abdcfc01e42c655f68a711146c6a97e52088de2a33469a8f15f1039724f3b5a982c7a5d04ca494f6d699161a1ae617c9a

C:\Windows\SysWOW64\czkawrrg.exe

MD5 531dba11c4de6f4bcf60d6c8addb2897
SHA1 9599d02999b0f5620597272b2af9392abfde8f2b
SHA256 d107a53cc3ee14dc0cfdedd9fe98d8c12e44bcced447a2470ce98f38634b8fda
SHA512 970ab458e1f043f5af32728b2b5d3b80bfab87b7e993188897e2ce12ad7fc2f72ce6e032489ba7cd73d452f99f55af74364f0bbd7ce454e175c1f60749b33ce1

C:\Windows\SysWOW64\ihxtsmgulyllt.exe

MD5 65b6821c31726e2003a990f0846bb1d0
SHA1 e24885ea7a313026790217e5cba9c086318d6e88
SHA256 b61890874fbb8a6f6c4e1f592a07b1545572726112dc1c25ad01efbdbcb74a6c
SHA512 9505835662c7b35874438bc86b8e1f6c4dd8b8d52bbf3ba3b346215b2af2f3e00e68693bc036451ce2fe1a5ea7c360abf307ba584500a2c9f70dd916c320ed57

memory/4736-35-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-38-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-41-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-42-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-40-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-39-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-44-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-45-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-43-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-46-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-47-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-48-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-49-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-50-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-52-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-51-0x00007FF8F0BE0000-0x00007FF8F0BF0000-memory.dmp

memory/4736-53-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-54-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-55-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-56-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-57-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-58-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-60-0x00007FF8F0BE0000-0x00007FF8F0BF0000-memory.dmp

memory/4736-59-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 169b02413ba48322b6fbad4f3a77f80a
SHA1 70507bdd7cf26cb72d2b8fd9a6a688ca6fe7961a
SHA256 f61ec79f6a628709fa5caffdb983268d7e5d616242e964965eedeeb8ce489d8b
SHA512 e3cd1e93d3db222bfa35013e7ebca482f6568beb67dde2117de8566faa1dc0b9af6b8706888d942aba7da6ff097b90fc390462ecd787ade8c302da6536d6a8c3

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 9f33644aebafe704ea95f56d15bcce4f
SHA1 efdd69d96aa4c3f4dbc850dd7760900b1f176657
SHA256 783b66292bfdc9896840aba8ddaedf0b54a891a2ca6494d0ab46403caa95bc82
SHA512 717ee9517d6443c72f3ad5fa7d7ab543cfea8878bc1f514293571c0dea991f1ea36baa3147e9e9d884c7b9ee54fea489260acc8a03bb3c4a326065666c4810a9

C:\Users\Admin\Documents\UninstallWrite.doc.exe

MD5 c445709d072026beb02f3a329d3f4076
SHA1 96cde023ceebcf6044ffdc73d6d7dea5418d76f6
SHA256 1af1d4bf518ccee3decd4220bd56e771e7e855f13fd1a2550a960f429dc849fa
SHA512 19e14b939eac462ff1269e5a41699a09770fff90688fb6b8a96e3625c6043186d5f3c09403450fcf0a240508d50179fed78514f48dd83a3febfa0dd22e5fd167

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 06949f63080ff619c3dac11cf7f3bf26
SHA1 5d6d81413550f989dbfac1733e8b4dab46828c5c
SHA256 a98927b59d2e69e96f5b3b719acca5aa30b9d93794741217e062af864605f4e7
SHA512 961d2cf1a63f1e3a64f970a26caae48e8cd5d9ae23d2aeaf893ccecee181a1dbf7f066dc282ba1bdcc241d79335bf0e0bec28ac6bda630b31f56fc0d7ba79854

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 15105f90ccc57fd963ae0bf164d07bb2
SHA1 8e0d0227cbe9daf86563a8eded658e00bdb50148
SHA256 c1550ea2de43c494fcc05fbd7419a3e91e75f1b2c02b1ed3875e7fc4a02db09b
SHA512 c6a247d4ae6128852d6ae597ed3d8df06fc2353d2e6c32d85efb54a89a3ace4b34a5427c10a8e95d25b7ae8d6e2eb6fea41fda75030cb8b63f0251a964bc02d7

memory/4736-111-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-112-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-113-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-114-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 fbda16ad4adeecfc76c0526ce11f2737
SHA1 42d31cc8794fdd47bf1dbe33ace2df1378a30e7a
SHA256 946365efee5d1776a858d5a47914f65cc2ad6da44499d2f06e3344e2b25ee866
SHA512 175c04d0bfdfd6af16bb44cb1b0c6cdcfc0c52376270caa26693b8201e3bc74ff395202ba7aade321e590f7b2e5adfb117c09854845c8330a6364dc1236447cb

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 32813d72f93727704612da08cf30a1dd
SHA1 79f393790bfaac083117c82d5ca42fec7320c0bc
SHA256 011a277e7ad57d06fba4dfc8b446b9c5da52663e545d4088da48cf22bb6a35c1
SHA512 c72471288b49588648adf2139746f30e43baa41e432b0eb570df62f67e1dfe2db529ecff80d8cce2d66cdb19bdc4d923ca184062ab3f1502ce352b95d0773875

memory/4736-149-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-150-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-151-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-152-0x00007FF8F3270000-0x00007FF8F3280000-memory.dmp

memory/4736-153-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-154-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-155-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp

memory/4736-156-0x00007FF9331F0000-0x00007FF9333E5000-memory.dmp