Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:05
Static task
static1
Behavioral task
behavioral1
Sample
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe
-
Size
512KB
-
MD5
6f13772fff6a75643fdc9c58d965ff33
-
SHA1
40d4de0e8980c6843c72a4c78d25bc6019796640
-
SHA256
5e1774d2991b5c972e6b34758a07f103ee31fdffa888fb622f2a6ea47da853d8
-
SHA512
c37893e94f7343b58eed1e3fcc3c60761aeac32e95d738b94453d1412fcdeabab13d5a733460d0ef4fb7a29cd7a38cd0335c28a96dc05ac7b9a439a6eb16e42b
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6H:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vwyvqxzkbj.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vwyvqxzkbj.exe -
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vwyvqxzkbj.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vwyvqxzkbj.exe -
Executes dropped EXE 5 IoCs
Processes:
vwyvqxzkbj.exegewmwqeehmfrggi.exeumussbgu.exenrorrmmedymfi.exeumussbgu.exepid process 3020 vwyvqxzkbj.exe 2636 gewmwqeehmfrggi.exe 2816 umussbgu.exe 2572 nrorrmmedymfi.exe 2612 umussbgu.exe -
Loads dropped DLL 5 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exepid process 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 3020 vwyvqxzkbj.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vwyvqxzkbj.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
gewmwqeehmfrggi.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yjprdxfc = "vwyvqxzkbj.exe" gewmwqeehmfrggi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mztwahzs = "gewmwqeehmfrggi.exe" gewmwqeehmfrggi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nrorrmmedymfi.exe" gewmwqeehmfrggi.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
umussbgu.exevwyvqxzkbj.exeumussbgu.exedescription ioc process File opened (read-only) \??\i: umussbgu.exe File opened (read-only) \??\b: vwyvqxzkbj.exe File opened (read-only) \??\v: vwyvqxzkbj.exe File opened (read-only) \??\b: umussbgu.exe File opened (read-only) \??\l: umussbgu.exe File opened (read-only) \??\p: umussbgu.exe File opened (read-only) \??\s: umussbgu.exe File opened (read-only) \??\u: umussbgu.exe File opened (read-only) \??\i: umussbgu.exe File opened (read-only) \??\i: vwyvqxzkbj.exe File opened (read-only) \??\g: umussbgu.exe File opened (read-only) \??\k: umussbgu.exe File opened (read-only) \??\t: umussbgu.exe File opened (read-only) \??\z: umussbgu.exe File opened (read-only) \??\z: umussbgu.exe File opened (read-only) \??\a: umussbgu.exe File opened (read-only) \??\n: umussbgu.exe File opened (read-only) \??\m: vwyvqxzkbj.exe File opened (read-only) \??\w: vwyvqxzkbj.exe File opened (read-only) \??\j: umussbgu.exe File opened (read-only) \??\h: umussbgu.exe File opened (read-only) \??\r: umussbgu.exe File opened (read-only) \??\z: vwyvqxzkbj.exe File opened (read-only) \??\a: vwyvqxzkbj.exe File opened (read-only) \??\s: vwyvqxzkbj.exe File opened (read-only) \??\x: vwyvqxzkbj.exe File opened (read-only) \??\y: vwyvqxzkbj.exe File opened (read-only) \??\q: umussbgu.exe File opened (read-only) \??\e: umussbgu.exe File opened (read-only) \??\g: umussbgu.exe File opened (read-only) \??\j: umussbgu.exe File opened (read-only) \??\w: umussbgu.exe File opened (read-only) \??\g: vwyvqxzkbj.exe File opened (read-only) \??\p: vwyvqxzkbj.exe File opened (read-only) \??\t: vwyvqxzkbj.exe File opened (read-only) \??\u: vwyvqxzkbj.exe File opened (read-only) \??\a: umussbgu.exe File opened (read-only) \??\q: umussbgu.exe File opened (read-only) \??\e: vwyvqxzkbj.exe File opened (read-only) \??\j: vwyvqxzkbj.exe File opened (read-only) \??\l: vwyvqxzkbj.exe File opened (read-only) \??\q: vwyvqxzkbj.exe File opened (read-only) \??\s: umussbgu.exe File opened (read-only) \??\x: umussbgu.exe File opened (read-only) \??\l: umussbgu.exe File opened (read-only) \??\m: umussbgu.exe File opened (read-only) \??\o: umussbgu.exe File opened (read-only) \??\t: umussbgu.exe File opened (read-only) \??\m: umussbgu.exe File opened (read-only) \??\x: umussbgu.exe File opened (read-only) \??\n: vwyvqxzkbj.exe File opened (read-only) \??\o: vwyvqxzkbj.exe File opened (read-only) \??\u: umussbgu.exe File opened (read-only) \??\v: umussbgu.exe File opened (read-only) \??\p: umussbgu.exe File opened (read-only) \??\e: umussbgu.exe File opened (read-only) \??\r: umussbgu.exe File opened (read-only) \??\k: umussbgu.exe File opened (read-only) \??\n: umussbgu.exe File opened (read-only) \??\h: umussbgu.exe File opened (read-only) \??\r: vwyvqxzkbj.exe File opened (read-only) \??\w: umussbgu.exe File opened (read-only) \??\y: umussbgu.exe File opened (read-only) \??\o: umussbgu.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
vwyvqxzkbj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" vwyvqxzkbj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" vwyvqxzkbj.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2864-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe C:\Windows\SysWOW64\gewmwqeehmfrggi.exe autoit_exe \Windows\SysWOW64\vwyvqxzkbj.exe autoit_exe \Windows\SysWOW64\umussbgu.exe autoit_exe \Windows\SysWOW64\nrorrmmedymfi.exe autoit_exe C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exedescription ioc process File created C:\Windows\SysWOW64\nrorrmmedymfi.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\vwyvqxzkbj.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File created C:\Windows\SysWOW64\gewmwqeehmfrggi.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gewmwqeehmfrggi.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File created C:\Windows\SysWOW64\umussbgu.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\umussbgu.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nrorrmmedymfi.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll vwyvqxzkbj.exe File created C:\Windows\SysWOW64\vwyvqxzkbj.exe 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe -
Drops file in Program Files directory 14 IoCs
Processes:
umussbgu.exeumussbgu.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe umussbgu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe umussbgu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal umussbgu.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe umussbgu.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe umussbgu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal umussbgu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe umussbgu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe umussbgu.exe -
Drops file in Windows directory 5 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEvwyvqxzkbj.exe6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh vwyvqxzkbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC9FAB1FE6AF194840C3A40869E3994B0FE02F94315023BE1C942E708A3" 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf vwyvqxzkbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B15C4492389A52CDBAD03292D4B8" 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0816BC6FF1F22DAD20FD1A68A7F9110" 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc vwyvqxzkbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs vwyvqxzkbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2620 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exegewmwqeehmfrggi.exeumussbgu.exenrorrmmedymfi.exeumussbgu.exepid process 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2816 umussbgu.exe 2816 umussbgu.exe 2816 umussbgu.exe 2816 umussbgu.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2612 umussbgu.exe 2612 umussbgu.exe 2612 umussbgu.exe 2612 umussbgu.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2636 gewmwqeehmfrggi.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exegewmwqeehmfrggi.exeumussbgu.exenrorrmmedymfi.exeumussbgu.exepid process 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2816 umussbgu.exe 2816 umussbgu.exe 2816 umussbgu.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2612 umussbgu.exe 2612 umussbgu.exe 2612 umussbgu.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exegewmwqeehmfrggi.exeumussbgu.exenrorrmmedymfi.exeumussbgu.exepid process 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 3020 vwyvqxzkbj.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2636 gewmwqeehmfrggi.exe 2816 umussbgu.exe 2816 umussbgu.exe 2816 umussbgu.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2572 nrorrmmedymfi.exe 2612 umussbgu.exe 2612 umussbgu.exe 2612 umussbgu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2620 WINWORD.EXE 2620 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exevwyvqxzkbj.exeWINWORD.EXEdescription pid process target process PID 2864 wrote to memory of 3020 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe vwyvqxzkbj.exe PID 2864 wrote to memory of 3020 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe vwyvqxzkbj.exe PID 2864 wrote to memory of 3020 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe vwyvqxzkbj.exe PID 2864 wrote to memory of 3020 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe vwyvqxzkbj.exe PID 2864 wrote to memory of 2636 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe gewmwqeehmfrggi.exe PID 2864 wrote to memory of 2636 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe gewmwqeehmfrggi.exe PID 2864 wrote to memory of 2636 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe gewmwqeehmfrggi.exe PID 2864 wrote to memory of 2636 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe gewmwqeehmfrggi.exe PID 2864 wrote to memory of 2816 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe umussbgu.exe PID 2864 wrote to memory of 2816 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe umussbgu.exe PID 2864 wrote to memory of 2816 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe umussbgu.exe PID 2864 wrote to memory of 2816 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe umussbgu.exe PID 2864 wrote to memory of 2572 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe nrorrmmedymfi.exe PID 2864 wrote to memory of 2572 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe nrorrmmedymfi.exe PID 2864 wrote to memory of 2572 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe nrorrmmedymfi.exe PID 2864 wrote to memory of 2572 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe nrorrmmedymfi.exe PID 3020 wrote to memory of 2612 3020 vwyvqxzkbj.exe umussbgu.exe PID 3020 wrote to memory of 2612 3020 vwyvqxzkbj.exe umussbgu.exe PID 3020 wrote to memory of 2612 3020 vwyvqxzkbj.exe umussbgu.exe PID 3020 wrote to memory of 2612 3020 vwyvqxzkbj.exe umussbgu.exe PID 2864 wrote to memory of 2620 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe WINWORD.EXE PID 2864 wrote to memory of 2620 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe WINWORD.EXE PID 2864 wrote to memory of 2620 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe WINWORD.EXE PID 2864 wrote to memory of 2620 2864 6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe WINWORD.EXE PID 2620 wrote to memory of 1732 2620 WINWORD.EXE splwow64.exe PID 2620 wrote to memory of 1732 2620 WINWORD.EXE splwow64.exe PID 2620 wrote to memory of 1732 2620 WINWORD.EXE splwow64.exe PID 2620 wrote to memory of 1732 2620 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f13772fff6a75643fdc9c58d965ff33_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vwyvqxzkbj.exevwyvqxzkbj.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\umussbgu.exeC:\Windows\system32\umussbgu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\gewmwqeehmfrggi.exegewmwqeehmfrggi.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\umussbgu.exeumussbgu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\nrorrmmedymfi.exenrorrmmedymfi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
7Impair Defenses
2Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
512KB
MD51f84de36ae52e15cc4f92b45ebf7d555
SHA18601b6dcfcdb83629b5951f483bf83190fc847b6
SHA2569c5f59e07633e10cc17f8d7867bd2176f111b0b1e0d79698d09a3ea86cc99150
SHA512b5066d4fec8585c7011c90545bd0a4b10af70f2487124c4f1926e97fc392cabf012950616e8a2eff2dd8242162a8ef9669fa45eb2c81ecac0668605fcf1168c9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotmFilesize
20KB
MD57a07660d56da22e3cda66530cdffa929
SHA17d56935fb988f0742aa2db6d6e34b2c7e99f7926
SHA256d951c119ad6a3ed2da1b1a2fda9bb3b2000457195fcadda6ac97d6ac3359029a
SHA512429a52bdccbc0fe76aa4e1005a9760f523059f84c7e293b3d17debb5368d9a748f8ab11fd81d180b8eed827771d4b6dcd897a97f2852ded3875149df3a5afe7e
-
C:\Windows\SysWOW64\gewmwqeehmfrggi.exeFilesize
512KB
MD5c226f077df924b09c5acb663cacfba9a
SHA10f8e2e825113d5f240b8261574d6e0c729d337dd
SHA25634484963ca6aa8fe04e6ad9c55591bdbf981bac160f59b7e614cada7c25fbec3
SHA512dfb938ea3e3fea47638faf588f067edb5f6d034aa91cda6a4b4bc3a80ef44b6bfe932ee3619657f6e173055a10e39407d39dc056bd6eee6486740176db622c63
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\nrorrmmedymfi.exeFilesize
512KB
MD5697bffe5c220682c83f8e6b6df8b2031
SHA15f6eda89eecd33842d035e05e9bc0a1fd25927bf
SHA2564f38dfd37cb0d28450293e443fb714aaa2f383be9c1fd35c15e814f4c1812110
SHA5122adca82e4ef1dc75ae90bb2e9a5b322ddc90007728b5569d6f8887e5bc6d86e78fd340e0473adbd9bab4bdbfca7867f4f754eaa71853a6df2deb035350ed5622
-
\Windows\SysWOW64\umussbgu.exeFilesize
512KB
MD5b7bf82833199120e7b95c91e3c4b6568
SHA1cc9f331731302496c6eadb867d6cfc6cf9de0b16
SHA256b26beebf37bc79d9674174b5f00823e6de95878787726a0f6ad417a8349086f3
SHA512a6953aff9d354b2895c79af802ef1d4987b0beafbedbf4000dbf82f26984ad9a5e5daa70f8a9c81112e5c8d4bda0e502606cfe085015c0f6f2f393060a00d739
-
\Windows\SysWOW64\vwyvqxzkbj.exeFilesize
512KB
MD570ceecc9a32edb08f24458d9d9b7c70d
SHA15428dad2756ae52d34ab13d349c815c7071f24f9
SHA256a53663449bbf7661baa1895a6eb3c85c0f59e672d7e54a728493680d69cdab13
SHA512233abe52c334e70a23ff895277753b54e60acedf8637f054ad320a4e142d07f9f853e4d008aae36b17560e669b9e3df9f30a42e3618215b0a4e6381af3c944f5
-
memory/2620-45-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2620-92-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2864-0-0x0000000000400000-0x0000000000496000-memory.dmpFilesize
600KB