Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 06:10
Static task
static1
Behavioral task
behavioral1
Sample
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe
-
Size
512KB
-
MD5
69fd6afa993e9a862157cc5a2549638d
-
SHA1
b3cd939c2494d90494b7eb33e185c5ab65da1c36
-
SHA256
a5bed8eee1a14c4cdf3fd3d794aca8963675bf951b0b1464952fe959dd510760
-
SHA512
be6e81ffb29708ce0e1c4741f5341c914f95ad69a8f893a772890c338dbf31532c10736c19b0bc08d1257e12ef3ad774f42d5d94b3c72ab76507828ef3b919d7
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wkauqqnaff.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wkauqqnaff.exe -
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wkauqqnaff.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wkauqqnaff.exe -
Executes dropped EXE 5 IoCs
Processes:
wkauqqnaff.exealywucgdyyqmkql.exezxqjdyih.exelrhhffvwhdayu.exezxqjdyih.exepid process 2644 wkauqqnaff.exe 2168 alywucgdyyqmkql.exe 2588 zxqjdyih.exe 2684 lrhhffvwhdayu.exe 2784 zxqjdyih.exe -
Loads dropped DLL 5 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exepid process 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2644 wkauqqnaff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wkauqqnaff.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
alywucgdyyqmkql.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zdzrovdj = "wkauqqnaff.exe" alywucgdyyqmkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xcreybjb = "alywucgdyyqmkql.exe" alywucgdyyqmkql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lrhhffvwhdayu.exe" alywucgdyyqmkql.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
zxqjdyih.exewkauqqnaff.exezxqjdyih.exedescription ioc process File opened (read-only) \??\b: zxqjdyih.exe File opened (read-only) \??\n: zxqjdyih.exe File opened (read-only) \??\o: zxqjdyih.exe File opened (read-only) \??\k: wkauqqnaff.exe File opened (read-only) \??\r: wkauqqnaff.exe File opened (read-only) \??\q: zxqjdyih.exe File opened (read-only) \??\r: zxqjdyih.exe File opened (read-only) \??\u: zxqjdyih.exe File opened (read-only) \??\y: zxqjdyih.exe File opened (read-only) \??\t: zxqjdyih.exe File opened (read-only) \??\u: wkauqqnaff.exe File opened (read-only) \??\i: zxqjdyih.exe File opened (read-only) \??\k: zxqjdyih.exe File opened (read-only) \??\s: zxqjdyih.exe File opened (read-only) \??\a: zxqjdyih.exe File opened (read-only) \??\w: zxqjdyih.exe File opened (read-only) \??\j: wkauqqnaff.exe File opened (read-only) \??\t: zxqjdyih.exe File opened (read-only) \??\b: zxqjdyih.exe File opened (read-only) \??\h: zxqjdyih.exe File opened (read-only) \??\i: zxqjdyih.exe File opened (read-only) \??\i: wkauqqnaff.exe File opened (read-only) \??\l: wkauqqnaff.exe File opened (read-only) \??\p: wkauqqnaff.exe File opened (read-only) \??\t: wkauqqnaff.exe File opened (read-only) \??\y: wkauqqnaff.exe File opened (read-only) \??\l: zxqjdyih.exe File opened (read-only) \??\m: zxqjdyih.exe File opened (read-only) \??\m: zxqjdyih.exe File opened (read-only) \??\r: zxqjdyih.exe File opened (read-only) \??\z: zxqjdyih.exe File opened (read-only) \??\b: wkauqqnaff.exe File opened (read-only) \??\o: zxqjdyih.exe File opened (read-only) \??\h: zxqjdyih.exe File opened (read-only) \??\g: wkauqqnaff.exe File opened (read-only) \??\v: wkauqqnaff.exe File opened (read-only) \??\j: zxqjdyih.exe File opened (read-only) \??\q: wkauqqnaff.exe File opened (read-only) \??\w: wkauqqnaff.exe File opened (read-only) \??\a: zxqjdyih.exe File opened (read-only) \??\e: zxqjdyih.exe File opened (read-only) \??\l: zxqjdyih.exe File opened (read-only) \??\e: wkauqqnaff.exe File opened (read-only) \??\q: zxqjdyih.exe File opened (read-only) \??\h: wkauqqnaff.exe File opened (read-only) \??\m: wkauqqnaff.exe File opened (read-only) \??\v: zxqjdyih.exe File opened (read-only) \??\v: zxqjdyih.exe File opened (read-only) \??\w: zxqjdyih.exe File opened (read-only) \??\o: wkauqqnaff.exe File opened (read-only) \??\z: wkauqqnaff.exe File opened (read-only) \??\g: zxqjdyih.exe File opened (read-only) \??\p: zxqjdyih.exe File opened (read-only) \??\x: zxqjdyih.exe File opened (read-only) \??\k: zxqjdyih.exe File opened (read-only) \??\y: zxqjdyih.exe File opened (read-only) \??\a: wkauqqnaff.exe File opened (read-only) \??\n: wkauqqnaff.exe File opened (read-only) \??\u: zxqjdyih.exe File opened (read-only) \??\x: wkauqqnaff.exe File opened (read-only) \??\e: zxqjdyih.exe File opened (read-only) \??\s: zxqjdyih.exe File opened (read-only) \??\g: zxqjdyih.exe File opened (read-only) \??\j: zxqjdyih.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
wkauqqnaff.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wkauqqnaff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wkauqqnaff.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2184-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\alywucgdyyqmkql.exe autoit_exe \Windows\SysWOW64\wkauqqnaff.exe autoit_exe \Windows\SysWOW64\zxqjdyih.exe autoit_exe \Windows\SysWOW64\lrhhffvwhdayu.exe autoit_exe C:\Program Files\SuspendCompare.doc.exe autoit_exe \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exedescription ioc process File created C:\Windows\SysWOW64\zxqjdyih.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\zxqjdyih.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lrhhffvwhdayu.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File created C:\Windows\SysWOW64\wkauqqnaff.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wkauqqnaff.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File created C:\Windows\SysWOW64\alywucgdyyqmkql.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\alywucgdyyqmkql.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File created C:\Windows\SysWOW64\lrhhffvwhdayu.exe 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wkauqqnaff.exe -
Drops file in Program Files directory 21 IoCs
Processes:
zxqjdyih.exezxqjdyih.exedescription ioc process File opened for modification C:\Program Files\SuspendCompare.nal zxqjdyih.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe zxqjdyih.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe zxqjdyih.exe File created \??\c:\Program Files\SuspendCompare.doc.exe zxqjdyih.exe File opened for modification C:\Program Files\SuspendCompare.doc.exe zxqjdyih.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal zxqjdyih.exe File opened for modification \??\c:\Program Files\SuspendCompare.doc.exe zxqjdyih.exe File opened for modification C:\Program Files\SuspendCompare.doc.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal zxqjdyih.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files\SuspendCompare.nal zxqjdyih.exe File opened for modification \??\c:\Program Files\SuspendCompare.doc.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe zxqjdyih.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe zxqjdyih.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal zxqjdyih.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe zxqjdyih.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXE69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0806BB1FF6E22DAD27FD1A88A7D9160" 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wkauqqnaff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wkauqqnaff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wkauqqnaff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wkauqqnaff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wkauqqnaff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wkauqqnaff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C0A9C5782236D4677D170512CDF7DF164DF" 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2624 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exezxqjdyih.exealywucgdyyqmkql.exelrhhffvwhdayu.exezxqjdyih.exepid process 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2168 alywucgdyyqmkql.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exealywucgdyyqmkql.exezxqjdyih.exelrhhffvwhdayu.exezxqjdyih.exepid process 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2168 alywucgdyyqmkql.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exezxqjdyih.exealywucgdyyqmkql.exelrhhffvwhdayu.exezxqjdyih.exepid process 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2644 wkauqqnaff.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2588 zxqjdyih.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2168 alywucgdyyqmkql.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2684 lrhhffvwhdayu.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe 2784 zxqjdyih.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2624 WINWORD.EXE 2624 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exewkauqqnaff.exeWINWORD.EXEdescription pid process target process PID 2184 wrote to memory of 2644 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe wkauqqnaff.exe PID 2184 wrote to memory of 2644 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe wkauqqnaff.exe PID 2184 wrote to memory of 2644 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe wkauqqnaff.exe PID 2184 wrote to memory of 2644 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe wkauqqnaff.exe PID 2184 wrote to memory of 2168 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe alywucgdyyqmkql.exe PID 2184 wrote to memory of 2168 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe alywucgdyyqmkql.exe PID 2184 wrote to memory of 2168 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe alywucgdyyqmkql.exe PID 2184 wrote to memory of 2168 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe alywucgdyyqmkql.exe PID 2184 wrote to memory of 2588 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe zxqjdyih.exe PID 2184 wrote to memory of 2588 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe zxqjdyih.exe PID 2184 wrote to memory of 2588 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe zxqjdyih.exe PID 2184 wrote to memory of 2588 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe zxqjdyih.exe PID 2184 wrote to memory of 2684 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe lrhhffvwhdayu.exe PID 2184 wrote to memory of 2684 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe lrhhffvwhdayu.exe PID 2184 wrote to memory of 2684 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe lrhhffvwhdayu.exe PID 2184 wrote to memory of 2684 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe lrhhffvwhdayu.exe PID 2644 wrote to memory of 2784 2644 wkauqqnaff.exe zxqjdyih.exe PID 2644 wrote to memory of 2784 2644 wkauqqnaff.exe zxqjdyih.exe PID 2644 wrote to memory of 2784 2644 wkauqqnaff.exe zxqjdyih.exe PID 2644 wrote to memory of 2784 2644 wkauqqnaff.exe zxqjdyih.exe PID 2184 wrote to memory of 2624 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe WINWORD.EXE PID 2184 wrote to memory of 2624 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe WINWORD.EXE PID 2184 wrote to memory of 2624 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe WINWORD.EXE PID 2184 wrote to memory of 2624 2184 69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe WINWORD.EXE PID 2624 wrote to memory of 2520 2624 WINWORD.EXE splwow64.exe PID 2624 wrote to memory of 2520 2624 WINWORD.EXE splwow64.exe PID 2624 wrote to memory of 2520 2624 WINWORD.EXE splwow64.exe PID 2624 wrote to memory of 2520 2624 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69fd6afa993e9a862157cc5a2549638d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkauqqnaff.exewkauqqnaff.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zxqjdyih.exeC:\Windows\system32\zxqjdyih.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\alywucgdyyqmkql.exealywucgdyyqmkql.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zxqjdyih.exezxqjdyih.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\lrhhffvwhdayu.exelrhhffvwhdayu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
7Impair Defenses
2Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\SuspendCompare.doc.exeFilesize
512KB
MD55e4af017d9db045cb37e17be61c9eded
SHA12b172011dbe4105c45efbea34a0de935e550435e
SHA256364a2f8a4a56a50973c773a7fb19b3462f862c51704c77b350de92fcc9696406
SHA51250047721b75344fa7e23304a6014f6e4d638cc4aca60d9e42c083d4b48127104ac0f7a3b794fe3793a86a4f69058b8549815206d4ab6a877bd848a2c9acf09bc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD56f6fa9559a2bd12004865dbcb04760ef
SHA1afa9bf459e9fd17a45f81d222e382b5a9a0e304f
SHA256c38edad34badd6d8ecdafb26837a3b8ef6b988f69d88906bb93440cdd20b332c
SHA5127b8658bd96b7c80b8210d70a08f90bbd0120d181a7a74e79342a10123d921093c8e6d328dcd366c5473c34f3476b2479e606e15014673c6c6107b9f2f912ad3c
-
C:\Windows\SysWOW64\alywucgdyyqmkql.exeFilesize
512KB
MD5aad0e65961e49c88948cb20b5d368e8a
SHA18b83810705384f58973303c115d4e287a472e0e0
SHA256e59f820216cf61e4308ffc48b73ca7a501ec2b38b891ba01d293a3e7d75b5562
SHA5123fc23736f9392fc835aab868ccd607a89a044ab772c0ed546b8d5630bfecb1c1609d653e97eb8beb9baca8f409ae20e40dd4645195834bdecb48adb41d656991
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exeFilesize
512KB
MD5fa932d4ae2372902e73bed1e6b705dd4
SHA18769ca44bf43d345cbc41f85d615d7e5dfdea66a
SHA2565a70a73f14cff35b04ecb8fa36b2df34fbaab5dbd3c6b3facecb66c5fbb6b391
SHA5120b7716c2fbd530f50648229ee38cf749e2668343a41c70014852d1a09a93c00cdc2a4f5d313a6f2333d3f7eea18ffab6aad6f5a81a1d118c4faaa9ca7ce17c7c
-
\Windows\SysWOW64\lrhhffvwhdayu.exeFilesize
512KB
MD531c1646252c884bc76be8aeff9e7a1c5
SHA1190d0ce3f52cf3c1135a2ba5efd62962fc54cf0a
SHA2566192c641029cbddcb928b4c389f5ede11a16ec59daed73fa16ffd8d0a3df5771
SHA512a234ca15ddbaa6d9cde088c871e975a9615520a1bda2f13e7087d06ca6c038d0d5e5fe06970d7895f44f7f0b3d3635b8f57b052d1ae3a3f57e95275a34f39fd4
-
\Windows\SysWOW64\wkauqqnaff.exeFilesize
512KB
MD598804965336adafbd033e1fd8479efdf
SHA199442408879c7609036b450b07afc7550b7a5e3e
SHA2563755f8f7eea5b9cd89c142850671feadf13c7e19a6d79e58c622e281a26fb774
SHA512867093836d8ca387771dea7b065706175ae2e88143cfc34996a002138107184cc4842f2010ef6d57fa714435c87fa0fdd26bba5555339499c2e474090f7567ef
-
\Windows\SysWOW64\zxqjdyih.exeFilesize
512KB
MD56167056736dc4c551d82558ca56776f5
SHA1d8724901fd84d827299f550d991f9031aff84df3
SHA256d2acc77aaf7fa2ff02e9a2c053dbe5a446c52bf7bb6c06e98350cba2d0d0a9fd
SHA5126424618409b176ab9b57cefbb00ec8f2a65a8db6d1fec19cd10bc6bd599c342cad0f6719c234a9a037e6ae52a544c9d66104d03eaa058fe9cff0c88eb5d51e49
-
memory/2184-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB
-
memory/2624-45-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2624-104-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB