97391f9f962ee36529fb67ec1890eb6180d472335284d5ba2dadd2d05cc33924

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
Size

512KB
MD5

054304c4eda80acb8fdffb9361446403
SHA1

42aaea03bfec9d291d0c2e0e2ebc848cf751994b
SHA256

97391f9f962ee36529fb67ec1890eb6180d472335284d5ba2dadd2d05cc33924
SHA512

e5e83f28635ef713130b38a6d960db6cbb4cd3272d8346c83a68ef10bf147da4536292e6c87343de8e0994a36ba77e67f45c111ae451d1e5217efecbb8549a21
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	zsooeoxpfq.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zsooeoxpfq.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	zsooeoxpfq.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zsooeoxpfq.exe

Executes dropped EXE 5 IoCs

Processes:

zsooeoxpfq.exeonzflvfpgcdfrmg.exetbxxstvstumew.exekdtgvxmh.exekdtgvxmh.exe

pid process

2960 zsooeoxpfq.exe
2620 onzflvfpgcdfrmg.exe
2400 tbxxstvstumew.exe
2512 kdtgvxmh.exe
2368 kdtgvxmh.exe

pid	process
2960	zsooeoxpfq.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2512	kdtgvxmh.exe
2368	kdtgvxmh.exe

Loads dropped DLL 5 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exezsooeoxpfq.exe

pid	process
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2960	zsooeoxpfq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	zsooeoxpfq.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

onzflvfpgcdfrmg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gnjatmwj = "zsooeoxpfq.exe"	onzflvfpgcdfrmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\glkqatlk = "onzflvfpgcdfrmg.exe"	onzflvfpgcdfrmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tbxxstvstumew.exe"	onzflvfpgcdfrmg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

kdtgvxmh.exekdtgvxmh.exezsooeoxpfq.exe

description	ioc	process
File opened (read-only)	\??\v:	kdtgvxmh.exe
File opened (read-only)	\??\k:	kdtgvxmh.exe
File opened (read-only)	\??\l:	kdtgvxmh.exe
File opened (read-only)	\??\n:	kdtgvxmh.exe
File opened (read-only)	\??\q:	kdtgvxmh.exe
File opened (read-only)	\??\w:	kdtgvxmh.exe
File opened (read-only)	\??\a:	zsooeoxpfq.exe
File opened (read-only)	\??\j:	kdtgvxmh.exe
File opened (read-only)	\??\v:	kdtgvxmh.exe
File opened (read-only)	\??\b:	zsooeoxpfq.exe
File opened (read-only)	\??\t:	kdtgvxmh.exe
File opened (read-only)	\??\t:	kdtgvxmh.exe
File opened (read-only)	\??\w:	zsooeoxpfq.exe
File opened (read-only)	\??\m:	kdtgvxmh.exe
File opened (read-only)	\??\h:	kdtgvxmh.exe
File opened (read-only)	\??\u:	kdtgvxmh.exe
File opened (read-only)	\??\j:	zsooeoxpfq.exe
File opened (read-only)	\??\l:	zsooeoxpfq.exe
File opened (read-only)	\??\u:	zsooeoxpfq.exe
File opened (read-only)	\??\p:	kdtgvxmh.exe
File opened (read-only)	\??\y:	kdtgvxmh.exe
File opened (read-only)	\??\b:	kdtgvxmh.exe
File opened (read-only)	\??\j:	kdtgvxmh.exe
File opened (read-only)	\??\b:	kdtgvxmh.exe
File opened (read-only)	\??\e:	kdtgvxmh.exe
File opened (read-only)	\??\m:	kdtgvxmh.exe
File opened (read-only)	\??\h:	zsooeoxpfq.exe
File opened (read-only)	\??\m:	zsooeoxpfq.exe
File opened (read-only)	\??\y:	zsooeoxpfq.exe
File opened (read-only)	\??\l:	kdtgvxmh.exe
File opened (read-only)	\??\e:	zsooeoxpfq.exe
File opened (read-only)	\??\t:	zsooeoxpfq.exe
File opened (read-only)	\??\x:	zsooeoxpfq.exe
File opened (read-only)	\??\u:	kdtgvxmh.exe
File opened (read-only)	\??\w:	kdtgvxmh.exe
File opened (read-only)	\??\p:	kdtgvxmh.exe
File opened (read-only)	\??\y:	kdtgvxmh.exe
File opened (read-only)	\??\e:	kdtgvxmh.exe
File opened (read-only)	\??\h:	kdtgvxmh.exe
File opened (read-only)	\??\i:	kdtgvxmh.exe
File opened (read-only)	\??\o:	kdtgvxmh.exe
File opened (read-only)	\??\k:	zsooeoxpfq.exe
File opened (read-only)	\??\n:	zsooeoxpfq.exe
File opened (read-only)	\??\p:	zsooeoxpfq.exe
File opened (read-only)	\??\q:	zsooeoxpfq.exe
File opened (read-only)	\??\g:	zsooeoxpfq.exe
File opened (read-only)	\??\v:	zsooeoxpfq.exe
File opened (read-only)	\??\k:	kdtgvxmh.exe
File opened (read-only)	\??\q:	kdtgvxmh.exe
File opened (read-only)	\??\z:	kdtgvxmh.exe
File opened (read-only)	\??\o:	kdtgvxmh.exe
File opened (read-only)	\??\r:	kdtgvxmh.exe
File opened (read-only)	\??\o:	zsooeoxpfq.exe
File opened (read-only)	\??\n:	kdtgvxmh.exe
File opened (read-only)	\??\g:	kdtgvxmh.exe
File opened (read-only)	\??\z:	kdtgvxmh.exe
File opened (read-only)	\??\i:	zsooeoxpfq.exe
File opened (read-only)	\??\x:	kdtgvxmh.exe
File opened (read-only)	\??\a:	kdtgvxmh.exe
File opened (read-only)	\??\g:	kdtgvxmh.exe
File opened (read-only)	\??\s:	kdtgvxmh.exe
File opened (read-only)	\??\x:	kdtgvxmh.exe
File opened (read-only)	\??\i:	kdtgvxmh.exe
File opened (read-only)	\??\z:	zsooeoxpfq.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

zsooeoxpfq.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	zsooeoxpfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	zsooeoxpfq.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
C:\Windows\SysWOW64\onzflvfpgcdfrmg.exe	autoit_exe
\Windows\SysWOW64\zsooeoxpfq.exe	autoit_exe
\Windows\SysWOW64\kdtgvxmh.exe	autoit_exe
C:\Windows\SysWOW64\tbxxstvstumew.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exezsooeoxpfq.exe

description	ioc	process
File created	C:\Windows\SysWOW64\kdtgvxmh.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tbxxstvstumew.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zsooeoxpfq.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\zsooeoxpfq.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\onzflvfpgcdfrmg.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\onzflvfpgcdfrmg.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\kdtgvxmh.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tbxxstvstumew.exe	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	zsooeoxpfq.exe

Drops file in Program Files directory 14 IoCs

Processes:

kdtgvxmh.exekdtgvxmh.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kdtgvxmh.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kdtgvxmh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kdtgvxmh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	kdtgvxmh.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kdtgvxmh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	kdtgvxmh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kdtgvxmh.exe

Drops file in Windows directory 5 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeWINWORD.EXEzsooeoxpfq.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D7B9C2683506A4276A6772E2DDE7DF165D8"	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	zsooeoxpfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	zsooeoxpfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	zsooeoxpfq.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAFABAFE67F1E4837C3A47869D3E91B088028C4313033FE2CC42ED08D4"	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1696 WINWORD.EXE

pid	process
1696	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeonzflvfpgcdfrmg.exezsooeoxpfq.exetbxxstvstumew.exekdtgvxmh.exekdtgvxmh.exe

pid	process
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2620	onzflvfpgcdfrmg.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2620	onzflvfpgcdfrmg.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2620	onzflvfpgcdfrmg.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeonzflvfpgcdfrmg.exezsooeoxpfq.exetbxxstvstumew.exekdtgvxmh.exekdtgvxmh.exe

pid	process
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeonzflvfpgcdfrmg.exezsooeoxpfq.exetbxxstvstumew.exekdtgvxmh.exekdtgvxmh.exe

pid	process
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2620	onzflvfpgcdfrmg.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2960	zsooeoxpfq.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2400	tbxxstvstumew.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2512	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe
2368	kdtgvxmh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1696 WINWORD.EXE
1696 WINWORD.EXE

pid	process
1696	WINWORD.EXE
1696	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

054304c4eda80acb8fdffb9361446403_JaffaCakes118.exeonzflvfpgcdfrmg.exezsooeoxpfq.exeWINWORD.EXE

description	pid	process	target process
PID 2888 wrote to memory of 2960	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	zsooeoxpfq.exe
PID 2888 wrote to memory of 2960	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	zsooeoxpfq.exe
PID 2888 wrote to memory of 2960	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	zsooeoxpfq.exe
PID 2888 wrote to memory of 2960	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	zsooeoxpfq.exe
PID 2888 wrote to memory of 2620	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	onzflvfpgcdfrmg.exe
PID 2888 wrote to memory of 2620	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	onzflvfpgcdfrmg.exe
PID 2888 wrote to memory of 2620	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	onzflvfpgcdfrmg.exe
PID 2888 wrote to memory of 2620	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	onzflvfpgcdfrmg.exe
PID 2888 wrote to memory of 2512	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	kdtgvxmh.exe
PID 2888 wrote to memory of 2512	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	kdtgvxmh.exe
PID 2888 wrote to memory of 2512	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	kdtgvxmh.exe
PID 2888 wrote to memory of 2512	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	kdtgvxmh.exe
PID 2620 wrote to memory of 2524	2620	onzflvfpgcdfrmg.exe	cmd.exe
PID 2620 wrote to memory of 2524	2620	onzflvfpgcdfrmg.exe	cmd.exe
PID 2620 wrote to memory of 2524	2620	onzflvfpgcdfrmg.exe	cmd.exe
PID 2620 wrote to memory of 2524	2620	onzflvfpgcdfrmg.exe	cmd.exe
PID 2888 wrote to memory of 2400	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	tbxxstvstumew.exe
PID 2888 wrote to memory of 2400	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	tbxxstvstumew.exe
PID 2888 wrote to memory of 2400	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	tbxxstvstumew.exe
PID 2888 wrote to memory of 2400	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	tbxxstvstumew.exe
PID 2960 wrote to memory of 2368	2960	zsooeoxpfq.exe	kdtgvxmh.exe
PID 2960 wrote to memory of 2368	2960	zsooeoxpfq.exe	kdtgvxmh.exe
PID 2960 wrote to memory of 2368	2960	zsooeoxpfq.exe	kdtgvxmh.exe
PID 2960 wrote to memory of 2368	2960	zsooeoxpfq.exe	kdtgvxmh.exe
PID 2888 wrote to memory of 1696	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	WINWORD.EXE
PID 2888 wrote to memory of 1696	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	WINWORD.EXE
PID 2888 wrote to memory of 1696	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	WINWORD.EXE
PID 2888 wrote to memory of 1696	2888	054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe	WINWORD.EXE
PID 1696 wrote to memory of 2764	1696	WINWORD.EXE	splwow64.exe
PID 1696 wrote to memory of 2764	1696	WINWORD.EXE	splwow64.exe
PID 1696 wrote to memory of 2764	1696	WINWORD.EXE	splwow64.exe
PID 1696 wrote to memory of 2764	1696	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\054304c4eda80acb8fdffb9361446403_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\zsooeoxpfq.exe
zsooeoxpfq.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\kdtgvxmh.exe
C:\Windows\system32\kdtgvxmh.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2368

C:\Windows\SysWOW64\onzflvfpgcdfrmg.exe
onzflvfpgcdfrmg.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c tbxxstvstumew.exe
3⤵
PID:2524

C:\Windows\SysWOW64\kdtgvxmh.exe
kdtgvxmh.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2512

C:\Windows\SysWOW64\tbxxstvstumew.exe
tbxxstvstumew.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2400

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:2764

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
Filesize
512KB

MD5
14e3574a43bb0e6930231fff4afc6b2d

SHA1
b2849e1c84c5acc03eba1948b9413b9c1d42bf0a

SHA256
ba1616556826816911b6ab377480f57e0ce4b62206604851aa7e2da6550819ae

SHA512
cd3d8b0fdac76171c3437a2618487e0b6a3b4d572dd48508391d3998d31566129eef18eee5fea99b88ee510ad24372d0606d0e460e17fa3359922ac650b665dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
512KB

MD5
152f01be7c4522ac56b78e66c5e0aa64

SHA1
696922ef7b6fe63f9788de44b6db74a68748e0ed

SHA256
b54285f413dbcf7f357389a01289adfbb5be8e416e6753d7a1913064d5a740b7

SHA512
d8d660a7a12c91077e37c41104e825526ddff7297a238433df4e1aa1c27f14d91c0ad86599fb867d86da6578d852e3f5ba77b7dcf4488404cc82d5f1ae7e14fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
33d297d19ea28d9078b74c72c0f318bf

SHA1
a24b2c91a1d76e75790c45105f8d7796371980ee

SHA256
58303b28ef66b18a0341534e5610887adfd3492125c226c6234709b105efc45e

SHA512
af968897cb87e1bf940940a2240f356eff587a0d11e33c22cf0f771e2d5c352f729008a0e2fa9373d65d7313e109705a6e2135853c550ce58de684afc5afe06e

Download Submit
C:\Windows\SysWOW64\onzflvfpgcdfrmg.exe
Filesize
512KB

MD5
83f9ae6aba831e3c7a14f5f61f356f35

SHA1
2a7e2b744afb7a56acbe91a0c0d59f598e6657dd

SHA256
87b0957c5434bfe5a8ada7adf30154b0ff5753b24ff2cf669bea15a8d0618669

SHA512
342aae865e42d3544863f2ad197c193488a5f581180adee42748d9a0a27c3e99c7e1338f1a09c98fa63454d42e8fd78d7478b7dc86d2d2b617a46b2549af31fa

Download Submit
C:\Windows\SysWOW64\tbxxstvstumew.exe
Filesize
512KB

MD5
646a4e98f9c824e7ce3470886a6888b3

SHA1
99b53f3bb24aaa4a8e515236395e2f07214a0f55

SHA256
fd0a605c96db6f347897755d0083df9e9259d18cf45bbea2dcb440ddfc6ce2b8

SHA512
5cd3bcd840ce43dcbf09de581fa3599803851895faf21e36db083ff196188f3fd1cfbd297b4124db8e06d0e0abc9ba95a1b3a828f89956321160a572cc316755

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\kdtgvxmh.exe
Filesize
512KB

MD5
28a238b28a6a72af32e8104e4b8ae901

SHA1
78c7c4799f1d34c37e7876e96b7a0440f7337ce9

SHA256
6576b441dbfca733e6b535515c7573cedafe85e4e38289c77f914c1dddbcb529

SHA512
19b5ee115f67fc3ca3fbc2b8c4ad605a46dfc9322b0399eda62fb884447a9d201baec457b3422ff5345d662f445bcbcfc7cc13fcffc8f678aee5813690a92c54

Download Submit
\Windows\SysWOW64\zsooeoxpfq.exe
Filesize
512KB

MD5
95cb904b8380241073fdab200896a34b

SHA1
bac11822dced4c1aeaf4d0ecb910e8cb7fe44ec9

SHA256
5434ea2725e13465ad3da8018538577b5a372591d67e3e051b6e67b2e061fddf

SHA512
20a78a561f3dede4b0430f6ea0d9de165d56b776346a93a84a5d95447be431c3d8fac1311da7154939a391b6e065d5050d558eb40a9771a073b32aa2a0a1276d

Download Submit
memory/1696-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1696-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2888-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads