b5dd5cea1ecc0a405ae86cfed890549b8a1a0f42bd30134bce119bac1744f964

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
Size

512KB
MD5

6f4ace3209e5b9fb06f752edb4d1d486
SHA1

cba0c3e04ad15dd54e84b101e9582468fe05a7d2
SHA256

b5dd5cea1ecc0a405ae86cfed890549b8a1a0f42bd30134bce119bac1744f964
SHA512

197f5efeabae9eeabe7b2212947890a987c157e76959b2b728c000de1384ce6b5cc2e3dd631f1a3370a343857f367cbdbe938bdee36a455a475f1095c5e37d18
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	jvwpqqjimy.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jvwpqqjimy.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	jvwpqqjimy.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jvwpqqjimy.exe

Executes dropped EXE 5 IoCs

Processes:

jvwpqqjimy.exedukgiyfnzublovd.exemqasnhweulxzc.exebfdtmxnc.exebfdtmxnc.exe

pid process

2616 jvwpqqjimy.exe
2724 dukgiyfnzublovd.exe
2468 mqasnhweulxzc.exe
2712 bfdtmxnc.exe
2656 bfdtmxnc.exe

pid	process
2616	jvwpqqjimy.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2712	bfdtmxnc.exe
2656	bfdtmxnc.exe

Loads dropped DLL 5 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exejvwpqqjimy.exe

pid	process
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
2616	jvwpqqjimy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	jvwpqqjimy.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dukgiyfnzublovd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uihlbqpy = "jvwpqqjimy.exe"	dukgiyfnzublovd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uqkfyinj = "dukgiyfnzublovd.exe"	dukgiyfnzublovd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mqasnhweulxzc.exe"	dukgiyfnzublovd.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bfdtmxnc.exejvwpqqjimy.exebfdtmxnc.exe

description	ioc	process
File opened (read-only)	\??\h:	bfdtmxnc.exe
File opened (read-only)	\??\u:	bfdtmxnc.exe
File opened (read-only)	\??\s:	bfdtmxnc.exe
File opened (read-only)	\??\g:	jvwpqqjimy.exe
File opened (read-only)	\??\h:	jvwpqqjimy.exe
File opened (read-only)	\??\i:	bfdtmxnc.exe
File opened (read-only)	\??\y:	bfdtmxnc.exe
File opened (read-only)	\??\q:	jvwpqqjimy.exe
File opened (read-only)	\??\s:	bfdtmxnc.exe
File opened (read-only)	\??\u:	bfdtmxnc.exe
File opened (read-only)	\??\a:	bfdtmxnc.exe
File opened (read-only)	\??\e:	bfdtmxnc.exe
File opened (read-only)	\??\v:	bfdtmxnc.exe
File opened (read-only)	\??\a:	bfdtmxnc.exe
File opened (read-only)	\??\b:	bfdtmxnc.exe
File opened (read-only)	\??\g:	bfdtmxnc.exe
File opened (read-only)	\??\l:	jvwpqqjimy.exe
File opened (read-only)	\??\w:	jvwpqqjimy.exe
File opened (read-only)	\??\x:	jvwpqqjimy.exe
File opened (read-only)	\??\t:	bfdtmxnc.exe
File opened (read-only)	\??\v:	bfdtmxnc.exe
File opened (read-only)	\??\x:	bfdtmxnc.exe
File opened (read-only)	\??\m:	bfdtmxnc.exe
File opened (read-only)	\??\a:	jvwpqqjimy.exe
File opened (read-only)	\??\j:	jvwpqqjimy.exe
File opened (read-only)	\??\p:	bfdtmxnc.exe
File opened (read-only)	\??\w:	bfdtmxnc.exe
File opened (read-only)	\??\p:	bfdtmxnc.exe
File opened (read-only)	\??\k:	jvwpqqjimy.exe
File opened (read-only)	\??\g:	bfdtmxnc.exe
File opened (read-only)	\??\x:	bfdtmxnc.exe
File opened (read-only)	\??\u:	jvwpqqjimy.exe
File opened (read-only)	\??\z:	jvwpqqjimy.exe
File opened (read-only)	\??\i:	jvwpqqjimy.exe
File opened (read-only)	\??\r:	bfdtmxnc.exe
File opened (read-only)	\??\w:	bfdtmxnc.exe
File opened (read-only)	\??\z:	bfdtmxnc.exe
File opened (read-only)	\??\j:	bfdtmxnc.exe
File opened (read-only)	\??\k:	bfdtmxnc.exe
File opened (read-only)	\??\n:	bfdtmxnc.exe
File opened (read-only)	\??\o:	bfdtmxnc.exe
File opened (read-only)	\??\t:	bfdtmxnc.exe
File opened (read-only)	\??\e:	bfdtmxnc.exe
File opened (read-only)	\??\e:	jvwpqqjimy.exe
File opened (read-only)	\??\n:	jvwpqqjimy.exe
File opened (read-only)	\??\y:	jvwpqqjimy.exe
File opened (read-only)	\??\q:	bfdtmxnc.exe
File opened (read-only)	\??\z:	bfdtmxnc.exe
File opened (read-only)	\??\j:	bfdtmxnc.exe
File opened (read-only)	\??\k:	bfdtmxnc.exe
File opened (read-only)	\??\b:	jvwpqqjimy.exe
File opened (read-only)	\??\b:	bfdtmxnc.exe
File opened (read-only)	\??\r:	bfdtmxnc.exe
File opened (read-only)	\??\l:	bfdtmxnc.exe
File opened (read-only)	\??\q:	bfdtmxnc.exe
File opened (read-only)	\??\m:	jvwpqqjimy.exe
File opened (read-only)	\??\h:	bfdtmxnc.exe
File opened (read-only)	\??\o:	bfdtmxnc.exe
File opened (read-only)	\??\y:	bfdtmxnc.exe
File opened (read-only)	\??\t:	jvwpqqjimy.exe
File opened (read-only)	\??\v:	jvwpqqjimy.exe
File opened (read-only)	\??\l:	bfdtmxnc.exe
File opened (read-only)	\??\m:	bfdtmxnc.exe
File opened (read-only)	\??\o:	jvwpqqjimy.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

jvwpqqjimy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	jvwpqqjimy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	jvwpqqjimy.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1832-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
C:\Windows\SysWOW64\dukgiyfnzublovd.exe	autoit_exe
\Windows\SysWOW64\jvwpqqjimy.exe	autoit_exe
C:\Windows\SysWOW64\bfdtmxnc.exe	autoit_exe
C:\Windows\SysWOW64\mqasnhweulxzc.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

jvwpqqjimy.exe6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	jvwpqqjimy.exe
File opened for modification	C:\Windows\SysWOW64\jvwpqqjimy.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dukgiyfnzublovd.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bfdtmxnc.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mqasnhweulxzc.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\jvwpqqjimy.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dukgiyfnzublovd.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bfdtmxnc.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mqasnhweulxzc.exe	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe

Drops file in Program Files directory 14 IoCs

Processes:

bfdtmxnc.exebfdtmxnc.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	bfdtmxnc.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bfdtmxnc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bfdtmxnc.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bfdtmxnc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bfdtmxnc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	bfdtmxnc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bfdtmxnc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	bfdtmxnc.exe

Drops file in Windows directory 5 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exejvwpqqjimy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	jvwpqqjimy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	jvwpqqjimy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9B1F966F1E783793A31869D39E6B3FC03F14311034CE1B845E608D5"	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B12C4795389F53BAB9A1329BD7C5"	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	jvwpqqjimy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2524 WINWORD.EXE

pid	process
2524	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exedukgiyfnzublovd.exemqasnhweulxzc.exejvwpqqjimy.exebfdtmxnc.exebfdtmxnc.exe

pid	process
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2724	dukgiyfnzublovd.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exedukgiyfnzublovd.exemqasnhweulxzc.exejvwpqqjimy.exebfdtmxnc.exebfdtmxnc.exe

pid	process
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exedukgiyfnzublovd.exemqasnhweulxzc.exejvwpqqjimy.exebfdtmxnc.exebfdtmxnc.exe

pid	process
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2724	dukgiyfnzublovd.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2468	mqasnhweulxzc.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2616	jvwpqqjimy.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2712	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe
2656	bfdtmxnc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2524 WINWORD.EXE
2524 WINWORD.EXE

pid	process
2524	WINWORD.EXE
2524	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exejvwpqqjimy.exeWINWORD.EXE

description	pid	process	target process
PID 1832 wrote to memory of 2616	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	jvwpqqjimy.exe
PID 1832 wrote to memory of 2616	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	jvwpqqjimy.exe
PID 1832 wrote to memory of 2616	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	jvwpqqjimy.exe
PID 1832 wrote to memory of 2616	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	jvwpqqjimy.exe
PID 1832 wrote to memory of 2724	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	dukgiyfnzublovd.exe
PID 1832 wrote to memory of 2724	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	dukgiyfnzublovd.exe
PID 1832 wrote to memory of 2724	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	dukgiyfnzublovd.exe
PID 1832 wrote to memory of 2724	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	dukgiyfnzublovd.exe
PID 1832 wrote to memory of 2712	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	bfdtmxnc.exe
PID 1832 wrote to memory of 2712	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	bfdtmxnc.exe
PID 1832 wrote to memory of 2712	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	bfdtmxnc.exe
PID 1832 wrote to memory of 2712	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	bfdtmxnc.exe
PID 1832 wrote to memory of 2468	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	mqasnhweulxzc.exe
PID 1832 wrote to memory of 2468	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	mqasnhweulxzc.exe
PID 1832 wrote to memory of 2468	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	mqasnhweulxzc.exe
PID 1832 wrote to memory of 2468	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	mqasnhweulxzc.exe
PID 2616 wrote to memory of 2656	2616	jvwpqqjimy.exe	bfdtmxnc.exe
PID 2616 wrote to memory of 2656	2616	jvwpqqjimy.exe	bfdtmxnc.exe
PID 2616 wrote to memory of 2656	2616	jvwpqqjimy.exe	bfdtmxnc.exe
PID 2616 wrote to memory of 2656	2616	jvwpqqjimy.exe	bfdtmxnc.exe
PID 1832 wrote to memory of 2524	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	WINWORD.EXE
PID 1832 wrote to memory of 2524	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	WINWORD.EXE
PID 1832 wrote to memory of 2524	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	WINWORD.EXE
PID 1832 wrote to memory of 2524	1832	6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe	WINWORD.EXE
PID 2524 wrote to memory of 676	2524	WINWORD.EXE	splwow64.exe
PID 2524 wrote to memory of 676	2524	WINWORD.EXE	splwow64.exe
PID 2524 wrote to memory of 676	2524	WINWORD.EXE	splwow64.exe
PID 2524 wrote to memory of 676	2524	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6f4ace3209e5b9fb06f752edb4d1d486_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\jvwpqqjimy.exe
jvwpqqjimy.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\bfdtmxnc.exe
C:\Windows\system32\bfdtmxnc.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2656

C:\Windows\SysWOW64\dukgiyfnzublovd.exe
dukgiyfnzublovd.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2724

C:\Windows\SysWOW64\bfdtmxnc.exe
bfdtmxnc.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712

C:\Windows\SysWOW64\mqasnhweulxzc.exe
mqasnhweulxzc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
Filesize
512KB

MD5
c80d60b61b8925ec5196dfa72af637f0

SHA1
2fa3c52521b12f798f85f1f1f25c41c13827b0d2

SHA256
db8962d313b4722e508e2072289b6f510f48751d82c5599ee49e709d52d8790d

SHA512
8eecb46089abeeae56fd3ba5258b5deaebc6633534fb4b14149416908dfbc273b58adaa5c3a4f98b5e71aed7ce381a26cee006cf74ec1874f82964c902652bf0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
512KB

MD5
9122f887fdee5ead166dac86a5ecd8bf

SHA1
cdaa0416a4bbad03dd12f8193a1d8db8a6c47fd8

SHA256
211b2ec0b068db8a0bd2592cf0ad1aa31bb5b8dd85741f26ebdc0ae58db74999

SHA512
b969e54387a8e7999f8800713dc095388b89005d9b899ed283a4350e0348695bd35bfd760084d4f200654f26f4006a4cdf949f575946fea3ca369982b3a56496

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
43040a655f5d7d781a65f2879ecb7de7

SHA1
aa09109d9ced30fd6ea7eff42a3cc1f4a3f5f25b

SHA256
1628ab6ffe70de178a9a2df2beb4cc09656d08ae980b5664f4bfed6b92f98915

SHA512
e8e3d2dcc64a86ddbaea76de41f4dbace25020d503c9fb55710f0cbff3ec595180dff45abcd5d444d2b433441944bbe0fd5ada4ce8193fdf45384b69aae59304

Download Submit
C:\Windows\SysWOW64\bfdtmxnc.exe
Filesize
512KB

MD5
79b2aecccd9ba9313e9562093cca5d79

SHA1
4209fcf007eec2182613ce9ab86aa7e17b93d956

SHA256
1c1c1e06515424d6096fd33bc3e856a2eac46724e61813f076e69836f64c9031

SHA512
f7767a7061ca8375d674d925b16bb1d842e28bc4d3c8b307663c7711f0153af138c94e858398e0223635677731c0144e0cabba5f23e34b9e01d4be42908937ae

Download Submit
C:\Windows\SysWOW64\dukgiyfnzublovd.exe
Filesize
512KB

MD5
1a5678ec3cf809e1756d0b130b268f7b

SHA1
f6f50b4b545fea3fc14aacf159bd33999df9bc50

SHA256
1b918e947e30d8274f752045894d8a6388a30ea7e15ac526ad5a11cca0f247a6

SHA512
eb0c3d72c7a9aa89f1bbcf6fe40378b45d4c3b96f122eab9b20312d2950877411bf349338a6b817a26f0092421448932f86369ebb0b6a9cc19ef0a0c1d5a060f

Download Submit
C:\Windows\SysWOW64\mqasnhweulxzc.exe
Filesize
512KB

MD5
fbd2a03238117cf26fbf1eff70497d2c

SHA1
6474a577e0ad93e7554f956ea7d35fb4949767c6

SHA256
fc8a5f71c92825185b5bcc8f8d77da682632e4a20ed572c438b9b266eb27addd

SHA512
e10b9606da23943ee6be457db6348a2db32c7e24ba45aa0b257b15db4cca6f7f401623c9cfe64cf44ff9821494f9efa48b4fe3e967ff9370b785688dae564b97

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\jvwpqqjimy.exe
Filesize
512KB

MD5
b2b268c2806ad11dbcc9a8795f650c79

SHA1
d20f3c5471afcbe0be283ca2f1f8b6d29d5c08a1

SHA256
7f7ffab0de10c4bb2d5aad4a1b01615154a50e63dd2b1317a3407a34d25b43a4

SHA512
a46991052df1a017e3eff2716f8a1886f35ab4b3d31c80cc448efda13dc7b16e025d227a8470f11e937b82216e655672bfbb911bc511abb3f3931b9acbc653ca

Download Submit
memory/1832-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2524-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2524-93-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads