7e12bae0d5ede6bc024333bd1a7eb7edfceffa0876043d274df30780864d09cc

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
Size

512KB
MD5

6faf8ed502a1238bf9952e8ef9cce25f
SHA1

200b03e5e2daf5f6be4e25036ef682091dd6d853
SHA256

7e12bae0d5ede6bc024333bd1a7eb7edfceffa0876043d274df30780864d09cc
SHA512

89fb2cc3a3f991d4156f425257a0624f84ca2d0d6d6955aff8628fae9ac61b7d8d6906bb6d4bda458028b2468b97ac610f9f503bc417a8203942302c40e8f33e
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bakgxglapy.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bakgxglapy.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bakgxglapy.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bakgxglapy.exe

Executes dropped EXE 5 IoCs

Processes:

bakgxglapy.exejfvzmdmdtvhincl.exebkfvhiro.exetxtndwqjyvvlc.exebkfvhiro.exe

pid process

2488 bakgxglapy.exe
2596 jfvzmdmdtvhincl.exe
2800 bkfvhiro.exe
2672 txtndwqjyvvlc.exe
2432 bkfvhiro.exe

pid	process
2488	bakgxglapy.exe
2596	jfvzmdmdtvhincl.exe
2800	bkfvhiro.exe
2672	txtndwqjyvvlc.exe
2432	bkfvhiro.exe

Loads dropped DLL 5 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exe

pid	process
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2488	bakgxglapy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	bakgxglapy.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

jfvzmdmdtvhincl.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\omtckzyp = "bakgxglapy.exe"	jfvzmdmdtvhincl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dwjaegeb = "jfvzmdmdtvhincl.exe"	jfvzmdmdtvhincl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "txtndwqjyvvlc.exe"	jfvzmdmdtvhincl.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bkfvhiro.exebkfvhiro.exebakgxglapy.exe

description	ioc	process
File opened (read-only)	\??\w:	bkfvhiro.exe
File opened (read-only)	\??\h:	bkfvhiro.exe
File opened (read-only)	\??\g:	bakgxglapy.exe
File opened (read-only)	\??\l:	bakgxglapy.exe
File opened (read-only)	\??\t:	bakgxglapy.exe
File opened (read-only)	\??\a:	bkfvhiro.exe
File opened (read-only)	\??\t:	bkfvhiro.exe
File opened (read-only)	\??\p:	bkfvhiro.exe
File opened (read-only)	\??\v:	bkfvhiro.exe
File opened (read-only)	\??\b:	bkfvhiro.exe
File opened (read-only)	\??\y:	bkfvhiro.exe
File opened (read-only)	\??\o:	bkfvhiro.exe
File opened (read-only)	\??\m:	bkfvhiro.exe
File opened (read-only)	\??\a:	bakgxglapy.exe
File opened (read-only)	\??\z:	bakgxglapy.exe
File opened (read-only)	\??\r:	bkfvhiro.exe
File opened (read-only)	\??\u:	bkfvhiro.exe
File opened (read-only)	\??\x:	bkfvhiro.exe
File opened (read-only)	\??\b:	bakgxglapy.exe
File opened (read-only)	\??\r:	bakgxglapy.exe
File opened (read-only)	\??\e:	bkfvhiro.exe
File opened (read-only)	\??\p:	bkfvhiro.exe
File opened (read-only)	\??\o:	bakgxglapy.exe
File opened (read-only)	\??\u:	bakgxglapy.exe
File opened (read-only)	\??\v:	bakgxglapy.exe
File opened (read-only)	\??\x:	bakgxglapy.exe
File opened (read-only)	\??\g:	bkfvhiro.exe
File opened (read-only)	\??\e:	bkfvhiro.exe
File opened (read-only)	\??\k:	bkfvhiro.exe
File opened (read-only)	\??\n:	bkfvhiro.exe
File opened (read-only)	\??\x:	bkfvhiro.exe
File opened (read-only)	\??\h:	bkfvhiro.exe
File opened (read-only)	\??\s:	bkfvhiro.exe
File opened (read-only)	\??\t:	bkfvhiro.exe
File opened (read-only)	\??\n:	bakgxglapy.exe
File opened (read-only)	\??\i:	bkfvhiro.exe
File opened (read-only)	\??\k:	bkfvhiro.exe
File opened (read-only)	\??\g:	bkfvhiro.exe
File opened (read-only)	\??\q:	bkfvhiro.exe
File opened (read-only)	\??\s:	bkfvhiro.exe
File opened (read-only)	\??\h:	bakgxglapy.exe
File opened (read-only)	\??\j:	bakgxglapy.exe
File opened (read-only)	\??\m:	bkfvhiro.exe
File opened (read-only)	\??\z:	bkfvhiro.exe
File opened (read-only)	\??\z:	bkfvhiro.exe
File opened (read-only)	\??\j:	bkfvhiro.exe
File opened (read-only)	\??\m:	bakgxglapy.exe
File opened (read-only)	\??\w:	bakgxglapy.exe
File opened (read-only)	\??\y:	bakgxglapy.exe
File opened (read-only)	\??\l:	bkfvhiro.exe
File opened (read-only)	\??\a:	bkfvhiro.exe
File opened (read-only)	\??\b:	bkfvhiro.exe
File opened (read-only)	\??\w:	bkfvhiro.exe
File opened (read-only)	\??\e:	bakgxglapy.exe
File opened (read-only)	\??\i:	bakgxglapy.exe
File opened (read-only)	\??\q:	bakgxglapy.exe
File opened (read-only)	\??\q:	bkfvhiro.exe
File opened (read-only)	\??\u:	bkfvhiro.exe
File opened (read-only)	\??\y:	bkfvhiro.exe
File opened (read-only)	\??\s:	bakgxglapy.exe
File opened (read-only)	\??\l:	bkfvhiro.exe
File opened (read-only)	\??\r:	bkfvhiro.exe
File opened (read-only)	\??\p:	bakgxglapy.exe
File opened (read-only)	\??\o:	bkfvhiro.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

bakgxglapy.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	bakgxglapy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	bakgxglapy.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
C:\Windows\SysWOW64\jfvzmdmdtvhincl.exe	autoit_exe
\Windows\SysWOW64\bakgxglapy.exe	autoit_exe
\Windows\SysWOW64\bkfvhiro.exe	autoit_exe
\Windows\SysWOW64\txtndwqjyvvlc.exe	autoit_exe
C:\Program Files\GrantFind.doc.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	autoit_exe
C:\Users\Admin\Downloads\CheckpointMount.doc.exe	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\txtndwqjyvvlc.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bakgxglapy.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bkfvhiro.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bkfvhiro.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\txtndwqjyvvlc.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bakgxglapy.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\jfvzmdmdtvhincl.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\jfvzmdmdtvhincl.exe	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	bakgxglapy.exe

Drops file in Program Files directory 21 IoCs

Processes:

bkfvhiro.exebkfvhiro.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\GrantFind.doc.exe	bkfvhiro.exe
File opened for modification	C:\Program Files\GrantFind.nal	bkfvhiro.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	bkfvhiro.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bkfvhiro.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bkfvhiro.exe
File created	\??\c:\Program Files\GrantFind.doc.exe	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files\GrantFind.nal	bkfvhiro.exe
File opened for modification	C:\Program Files\GrantFind.doc.exe	bkfvhiro.exe
File opened for modification	\??\c:\Program Files\GrantFind.doc.exe	bkfvhiro.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files\GrantFind.doc.exe	bkfvhiro.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bkfvhiro.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	bkfvhiro.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	bkfvhiro.exe

Drops file in Windows directory 5 IoCs

Processes:

WINWORD.EXE6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEbakgxglapy.exe6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	bakgxglapy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	bakgxglapy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	bakgxglapy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7876BB8FF1B21DBD27BD1A48B09906A"	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	bakgxglapy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFFAC9FE6BF293837D3B4586963995B38B038B4360034BE1BF429C08A6"	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412C799C2283586D3476D770532CDF7C8E65AB"	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2400 WINWORD.EXE

pid	process
2400	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exebkfvhiro.exejfvzmdmdtvhincl.exebkfvhiro.exetxtndwqjyvvlc.exe

pid	process
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2596	jfvzmdmdtvhincl.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exebkfvhiro.exejfvzmdmdtvhincl.exetxtndwqjyvvlc.exebkfvhiro.exe

pid	process
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exebkfvhiro.exejfvzmdmdtvhincl.exetxtndwqjyvvlc.exebkfvhiro.exe

pid	process
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2488	bakgxglapy.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2800	bkfvhiro.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2596	jfvzmdmdtvhincl.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2672	txtndwqjyvvlc.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe
2432	bkfvhiro.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2400 WINWORD.EXE
2400 WINWORD.EXE

pid	process
2400	WINWORD.EXE
2400	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exebakgxglapy.exeWINWORD.EXE

description	pid	process	target process
PID 2992 wrote to memory of 2488	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bakgxglapy.exe
PID 2992 wrote to memory of 2488	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bakgxglapy.exe
PID 2992 wrote to memory of 2488	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bakgxglapy.exe
PID 2992 wrote to memory of 2488	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bakgxglapy.exe
PID 2992 wrote to memory of 2596	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	jfvzmdmdtvhincl.exe
PID 2992 wrote to memory of 2596	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	jfvzmdmdtvhincl.exe
PID 2992 wrote to memory of 2596	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	jfvzmdmdtvhincl.exe
PID 2992 wrote to memory of 2596	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	jfvzmdmdtvhincl.exe
PID 2992 wrote to memory of 2800	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bkfvhiro.exe
PID 2992 wrote to memory of 2800	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bkfvhiro.exe
PID 2992 wrote to memory of 2800	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bkfvhiro.exe
PID 2992 wrote to memory of 2800	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	bkfvhiro.exe
PID 2992 wrote to memory of 2672	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	txtndwqjyvvlc.exe
PID 2992 wrote to memory of 2672	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	txtndwqjyvvlc.exe
PID 2992 wrote to memory of 2672	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	txtndwqjyvvlc.exe
PID 2992 wrote to memory of 2672	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	txtndwqjyvvlc.exe
PID 2488 wrote to memory of 2432	2488	bakgxglapy.exe	bkfvhiro.exe
PID 2488 wrote to memory of 2432	2488	bakgxglapy.exe	bkfvhiro.exe
PID 2488 wrote to memory of 2432	2488	bakgxglapy.exe	bkfvhiro.exe
PID 2488 wrote to memory of 2432	2488	bakgxglapy.exe	bkfvhiro.exe
PID 2992 wrote to memory of 2400	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	WINWORD.EXE
PID 2992 wrote to memory of 2400	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	WINWORD.EXE
PID 2992 wrote to memory of 2400	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	WINWORD.EXE
PID 2992 wrote to memory of 2400	2992	6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe	WINWORD.EXE
PID 2400 wrote to memory of 2680	2400	WINWORD.EXE	splwow64.exe
PID 2400 wrote to memory of 2680	2400	WINWORD.EXE	splwow64.exe
PID 2400 wrote to memory of 2680	2400	WINWORD.EXE	splwow64.exe
PID 2400 wrote to memory of 2680	2400	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6faf8ed502a1238bf9952e8ef9cce25f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\bakgxglapy.exe
bakgxglapy.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\bkfvhiro.exe
C:\Windows\system32\bkfvhiro.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2432

C:\Windows\SysWOW64\jfvzmdmdtvhincl.exe
jfvzmdmdtvhincl.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2596

C:\Windows\SysWOW64\bkfvhiro.exe
bkfvhiro.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2800

C:\Windows\SysWOW64\txtndwqjyvvlc.exe
txtndwqjyvvlc.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2672

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:2680

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
Filesize
512KB

MD5
4b39dbcb168014ae17b0f3638a32c1f0

SHA1
26561d1daa490bdd3061699d8b34d49ae12e3f4f

SHA256
acf8ada4f5baf6121c70e55986be05be237fa23c4fea45ad488b9f195bb75c9e

SHA512
e3d33c51c964ade2c7789d5663a092b4d6bb3fed0b4ae4f5cc08cb3900d52d1dad25cd34a62207ce7c46e77d75ffe16dc0f347f9094133ab8e653ef4e982dc13

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
512KB

MD5
b009922eb79ec260a24578e0097ae0d4

SHA1
2ffac34f7f099fa6cb8ca7a33082bb4dbc08de89

SHA256
9557c49af746ed8d4049b47beb55948bb9c346c981861cf44e5670e706ce238d

SHA512
3f3abe7a109bbfd1c936362e5bd615c14fb1469a59b2e1ea8b31a9e6b8dd24bdb2c951461750cdf75025fb964b591248531bba3d46cc2362b4c899076443d297

Download Submit
C:\Program Files\GrantFind.doc.exe
Filesize
512KB

MD5
81930aa03ff6e07cab1dfb3409050816

SHA1
998d43ad4d40454ba6d209618257616baf86fd6c

SHA256
70970621a64c2d2ece84071ae38bd4a65103d3161794995b674677f22213121c

SHA512
5fcf747137f0c3d9f019cc6770886f57c02a1cdfdafbe513f97159556cbd7d62365cf8cd5e3e27cbfddd19a16878b049f1017b1bda2f676f042445d605286378

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
201fd7810e3e4a8d57a13b8e68b56523

SHA1
0fa30f81d5e242336ccfd60b00fec9e3eebd4880

SHA256
cf984f3af516c831f105a8a6b0f2b05dfeb2ea117f5caaf2249db4ef8f99d832

SHA512
c945fbd0a2966c6e2805480cdbf6cc0c36ca5b3701b455ac45da209b6201add1624080d79b97a3e3f9eb9c5fc2428f2282d085411396f154ac2748130ad294fe

Download Submit
C:\Users\Admin\Downloads\CheckpointMount.doc.exe
Filesize
512KB

MD5
66d8e9e96149d53d8e50db50a47d1888

SHA1
7c72f8bbf2755494232b80215ee6a8471e882539

SHA256
58d063c80860c4184df807e7b9660189efc20a1ca0dda00543d7f8b63a826fab

SHA512
289fdea5f708dd900b28352c2222513f70b4e6e6b4c0d6b6ce8317af67b905df61b7fd1458048c6255bf5259b3ffc672ef4861277147756f70746991464eba96

Download Submit
C:\Windows\SysWOW64\jfvzmdmdtvhincl.exe
Filesize
512KB

MD5
bc874eba5fce2bb8fbddca1027326661

SHA1
3e3089a17934f2bf6cf577ef5a6c4fab9acc3cb7

SHA256
2d28fb6c0193744bf06d575528a0fa9bddd6ad7cbb6dca3cb30fe8407cdedc5e

SHA512
af9d52a2d020c078ad44e56ae14d7e3f3aaf07de00054b1f37c663062d01717c1639d8e0e8895ec864dae5205cbcbb00d34c62fc01e4b61fc3408bf824fddb07

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\bakgxglapy.exe
Filesize
512KB

MD5
a20c594a15fee195c973b45e86683959

SHA1
b1ad485838d01be6b36f4a8c4d10e9151e5f3d63

SHA256
2d7af34ec0d4ece7526cd0b91470b26f9b913aa0afafb19ba46b21456a662295

SHA512
6cc9dc6969e48168c0190a87d28051986d740fc8877b70576aa1919bddf6c6c8104bbdc6761969f32cdecc15fe467687ada5b159aa4dd483339f90cdcc434e6a

Download Submit
\Windows\SysWOW64\bkfvhiro.exe
Filesize
512KB

MD5
47f99401b6efb77daf847eee60da285e

SHA1
0ed40229123392980860b1c23d4b0302be29573e

SHA256
4cae8955d0e69eb8cbef269d48acd98b7d4b7ddf258e043772717850cd49f309

SHA512
cd16c826c396a4041a2cfdd9d86531b6748632017a8a9c8b24144b5b4030fc4dd13740e36caf02e2ce7501152e4005632d6c562daf048aa1ecf0f122a2415d87

Download Submit
\Windows\SysWOW64\txtndwqjyvvlc.exe
Filesize
512KB

MD5
750082d7e120d9d40a09a4d53eb839a2

SHA1
262fa587a945d4cf7423be50f08c368fddcbfe7e

SHA256
347b2de880a8028b5a9670d39141ffd133cffff32993141b2a973e61baed5898

SHA512
f393eec3e0ee99e8be47460a28bdcb69f0c9197da35db613e67a2df0910b5526c935afa8d3b1cbf58437377bfcedf2d104a6fa0668de3cdd541313956627cde4

Download Submit
memory/2400-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2400-110-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2992-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads