Malware Analysis Report

2025-01-06 10:32

Sample ID 240601-dypxesgg87
Target 893cea07129af938056f726cdc6c5940_JaffaCakes118
SHA256 a736f4f4091ec120fba8ecd0cdb1c1058c1ce959d5ae7a8d731bfe5dd83dade6
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a736f4f4091ec120fba8ecd0cdb1c1058c1ce959d5ae7a8d731bfe5dd83dade6

Threat Level: Known bad

The file 893cea07129af938056f726cdc6c5940_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Windows security modification

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Modifies WinLogon

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

AutoIT Executable

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Modifies Internet Explorer settings

Modifies registry class

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 03:25

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 03:25

Reported

2024-06-01 03:27

Platform

win7-20240221-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ypzuqjkj = "tbdhtespwraitta.exe" C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "djkjurnobrume.exe" C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufzwecnu = "ywdhaboqrw.exe" C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\n: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
File opened for modification C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tbdhtespwraitta.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hnslamjx.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\djkjurnobrume.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\tbdhtespwraitta.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hnslamjx.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\djkjurnobrume.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hnslamjx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hnslamjx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hnslamjx.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC3B15D449439EE53CFBAA6329FD4CE" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8FACDF910F19184743B4481983E91B388038F4369034BE2CA459D08D2" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F46BB3FF6E22DFD20CD0D48A0C9016" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C70E1491DBBEB9BC7C97ED9534BC" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
N/A N/A C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
N/A N/A C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
N/A N/A C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
N/A N/A C:\Windows\SysWOW64\ywdhaboqrw.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\hnslamjx.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\djkjurnobrume.exe N/A
N/A N/A C:\Windows\SysWOW64\tbdhtespwraitta.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ywdhaboqrw.exe
PID 2820 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ywdhaboqrw.exe
PID 2820 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ywdhaboqrw.exe
PID 2820 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ywdhaboqrw.exe
PID 2820 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\tbdhtespwraitta.exe
PID 2820 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\tbdhtespwraitta.exe
PID 2820 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\tbdhtespwraitta.exe
PID 2820 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\tbdhtespwraitta.exe
PID 2820 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2820 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2820 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2820 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2820 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\djkjurnobrume.exe
PID 2820 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\djkjurnobrume.exe
PID 2820 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\djkjurnobrume.exe
PID 2820 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\djkjurnobrume.exe
PID 2844 wrote to memory of 2372 N/A C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2844 wrote to memory of 2372 N/A C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2844 wrote to memory of 2372 N/A C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2844 wrote to memory of 2372 N/A C:\Windows\SysWOW64\ywdhaboqrw.exe C:\Windows\SysWOW64\hnslamjx.exe
PID 2820 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2820 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2820 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2820 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2392 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2392 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2392 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2392 wrote to memory of 2004 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe"

C:\Windows\SysWOW64\ywdhaboqrw.exe

ywdhaboqrw.exe

C:\Windows\SysWOW64\tbdhtespwraitta.exe

tbdhtespwraitta.exe

C:\Windows\SysWOW64\hnslamjx.exe

hnslamjx.exe

C:\Windows\SysWOW64\djkjurnobrume.exe

djkjurnobrume.exe

C:\Windows\SysWOW64\hnslamjx.exe

C:\Windows\system32\hnslamjx.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

memory/2392-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\SysWOW64\hnslamjx.exe

MD5 43412d9d61ccc82cac9367c860609144
SHA1 9fd19ec6f0c0c7e543a3598bf931b0450bd6a44e
SHA256 b23efd6ef8a323172e619cd2bfc85a12447a46bee820309ab3a27a1ec3a1ceae
SHA512 dd63d4522fbffdc7292626ebf6868f2635076933909590cef499f07c10b2d9834e4fab39118db5f4eeea1fc43f6bb7a258d76ced247688d5d9cacad03b48964f

C:\Windows\SysWOW64\djkjurnobrume.exe

MD5 bc92c4228da79546342c2c3743e8e7d0
SHA1 a9d987af051782b77e8b3c2ac10897efc56f13f1
SHA256 956bfcb0b457e47818b5bc7281f659dc318ee1b74c10c8fda35fae6a5492ac64
SHA512 bd2bd56d2c635b309e3004d3254c696f4aea7fd3e7da16c9c4a5db0382f6b5a02e625232a204b0ce3f79f298e9a5e8f349d2e20694117df9be7555e4c15c263d

C:\Windows\SysWOW64\tbdhtespwraitta.exe

MD5 49ceb22fa47ceae109b869e77322ccbf
SHA1 24181a93e88c28e650512f877198243119cc2d3c
SHA256 6311cb2f712e22540a528b399eb8cde875a91409c1233b0efdcd8340c3b6c8cb
SHA512 b850ae7e9226619b8bbd67549052118cb24c0db3ffc3235b53b846b874ad494ce03a43eb6511ca5e3d3ee97663abc6258d2b9504fdbcd7ebf4969e03b4278ea4

C:\Windows\SysWOW64\ywdhaboqrw.exe

MD5 9bae5ef8bd811775a4ccfd913bcf4132
SHA1 9c7da8947c5403daf11be933fde7acd94c5a5879
SHA256 1e200c8da80ea32bb2b6f8847dd6b7b111b0ab75429dd48499c3bb8f447b65b0
SHA512 43fb496ebe6c93c71e554fa82f594f822e74b95b4d9e0141d753059c0135e65e53e739687987369bf314033c27c522dee2b8618440de4a50d8002d59989c39e7

memory/2820-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 5c65347e91044134d70080a9557f4df5
SHA1 e04766ff280e6b9f2b0565bd85f47088c8d0d1bb
SHA256 486a6406ac674bcca7efeae940fe5cc7bca2c662d532ef357b68a70b1ab46e0c
SHA512 8a396543a622d941c5684dca99633f3cf01c29ab580fbc7d5dbb6b457aff7e3db132edb551ce3d6052c57ad0c4d19ea2f288f37de213eeab57566591048115ca

C:\Users\Admin\AppData\Roaming\CheckpointConfirm.doc.exe

MD5 1cc647df5d2249992c4e4da2269cfd5a
SHA1 05692006c814b09fceb9b8382bdf89098cb9f8ad
SHA256 3e64571aced10247d37f6f611ed8bbdd0da9dce832d9472de85198156fdecb19
SHA512 2dc3ca30e428c83c119c983faff1ebe22df65ccb9a87f352b693c08b0c299c8d7b485bd7067cf26b911b484a27e643b70700cbeeed3869afebf4f29bfa1d441d

C:\Users\Admin\AppData\Roaming\RenameRestore.doc.exe

MD5 d80901de6469f39ece0492de1f8cddd0
SHA1 778aab8d9a2839f0a6afccc4648a04ebe0e60e79
SHA256 cbb5b8c12dca6545d39fc03b5341b2bfd9163af988bd8ade0677d2634f2e4c23
SHA512 5d7fdd5e1be67b23f58c08252b85059ac5c27ec1cff808b6a6ed6a4ea7ee88a5eb7898bb3a6f5f80a28719563b2360be990c08ca8379f4dbe82c18a3cbefc4af

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 1b1fee3d0da7eef237f8e192ef5feaff
SHA1 c7c85c360cb4d4285487c5cb18b92dceded6038d
SHA256 977ff0c5491035ed6c84c019e189b880360b5d396d03c9981e5bcf8d1d2d5ea3
SHA512 9b19bc89eab0e3f3de0fd0d92cdd73805e1a2891269eb3e05b1fd4b956cd9353077382b5a359ff5f6816c0e544447170685089abdcf2c14ddae743f895deff91

memory/2392-105-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-01 03:25

Reported

2024-06-01 03:27

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\phvupnqw = "ubzsqdftcq.exe" C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gqbhkayu = "gnybgpxltylqdrg.exe" C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jxoskrspcfilp.exe" C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\k: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\dcyiirsm.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\dcyiirsm.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\dcyiirsm.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
File opened for modification C:\Windows\SysWOW64\gnybgpxltylqdrg.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\jxoskrspcfilp.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\jxoskrspcfilp.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created C:\Windows\SysWOW64\ubzsqdftcq.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ubzsqdftcq.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\gnybgpxltylqdrg.exe C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\dcyiirsm.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFC8F482F82129133D65A7E96BC94E1315941674E6332D6EB" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC9FABAFE64F1E0830C3A4181EC39E4B38B03FD43640238E1CA459B08D4" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B12944E739EB53BEB9D033EFD7CB" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462C7A9D2382256D4676D470202DDA7DF665D8" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F16BC4FF1D22DDD10BD0A08B789014" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC70915E0DAB3B8CF7CE5EC9737CC" C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\ubzsqdftcq.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\ubzsqdftcq.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\gnybgpxltylqdrg.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\jxoskrspcfilp.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A
N/A N/A C:\Windows\SysWOW64\dcyiirsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1748 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ubzsqdftcq.exe
PID 1748 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ubzsqdftcq.exe
PID 1748 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\ubzsqdftcq.exe
PID 1748 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\gnybgpxltylqdrg.exe
PID 1748 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\gnybgpxltylqdrg.exe
PID 1748 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\gnybgpxltylqdrg.exe
PID 1748 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\dcyiirsm.exe
PID 1748 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\dcyiirsm.exe
PID 1748 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\dcyiirsm.exe
PID 1748 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\jxoskrspcfilp.exe
PID 1748 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\jxoskrspcfilp.exe
PID 1748 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Windows\SysWOW64\jxoskrspcfilp.exe
PID 1748 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1748 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1224 wrote to memory of 1964 N/A C:\Windows\SysWOW64\ubzsqdftcq.exe C:\Windows\SysWOW64\dcyiirsm.exe
PID 1224 wrote to memory of 1964 N/A C:\Windows\SysWOW64\ubzsqdftcq.exe C:\Windows\SysWOW64\dcyiirsm.exe
PID 1224 wrote to memory of 1964 N/A C:\Windows\SysWOW64\ubzsqdftcq.exe C:\Windows\SysWOW64\dcyiirsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\893cea07129af938056f726cdc6c5940_JaffaCakes118.exe"

C:\Windows\SysWOW64\ubzsqdftcq.exe

ubzsqdftcq.exe

C:\Windows\SysWOW64\gnybgpxltylqdrg.exe

gnybgpxltylqdrg.exe

C:\Windows\SysWOW64\dcyiirsm.exe

dcyiirsm.exe

C:\Windows\SysWOW64\jxoskrspcfilp.exe

jxoskrspcfilp.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\dcyiirsm.exe

C:\Windows\system32\dcyiirsm.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.184:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 184.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/1748-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\gnybgpxltylqdrg.exe

MD5 11257935860cc9d414c7fa2adff49afe
SHA1 d0b052622c1e70bb455d2661f91a667c7a5f1ea9
SHA256 fb1bdb3417cd5235562a9a0366cc66f36e1cc5a31ebd2fe593e3249f22294e59
SHA512 d710817d9e5fee6a18516bca710809e9b4b514616a0c5d60dc1b9a3d3703cb20c9d6f57f285574d6910e1dc519f9b3d71cdb5c7674a0d72c56daafbbca525ba7

C:\Windows\SysWOW64\ubzsqdftcq.exe

MD5 b9fee795311ee3c38cc8d5de0da668f6
SHA1 9623424e915a3467473307e8072d03ee6bff3fb4
SHA256 a686df3a383225f5bb603a693423a0b4597cf1ad54ce77563fde79d74e0f2793
SHA512 0351d5c2088809fe308f6f1c754201594a3a17ebc7b6df171410eac688485a9a64b2d21290c38ff68e70e50a8cd7d3a313862afe45cadbb115bd6b5e29f15839

C:\Windows\SysWOW64\dcyiirsm.exe

MD5 90f8c29ae0234de0418363493b51244e
SHA1 3735398577fc7924f210ab61f69ebab5b56a2696
SHA256 03cebd5d6c7a9196e02b7185f84f892607bd3b22d2bbc15e7b93154352cce2c4
SHA512 38e3f89cc10842c3772110f9c0d935e263bf28cd838e5768494f0d1135cf20ac7ab374c2f6592b1f00a591afa06fe6d4685c5160281b715a1d8647628d17b47e

C:\Windows\SysWOW64\jxoskrspcfilp.exe

MD5 c9900c097bb688071897bf0ee5e6d863
SHA1 1a5541923e29eeacf6769ae38aa5e53af8142032
SHA256 cc5a246ae55a6f8f594eef44965a365f054488a03acbb47caebaa2a1c44eae20
SHA512 4ab01e6ba12c70a58698c072a41c21d61874141aa8582409cb05aec85a4798ff56b1268fa2596388518b8f8a927459d3e543d12d0178ed1530b6d0d721bdeb96

memory/1192-35-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-37-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-36-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-38-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-39-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-40-0x00007FFD5E690000-0x00007FFD5E6A0000-memory.dmp

memory/1192-43-0x00007FFD5E690000-0x00007FFD5E6A0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 611fa7e88ecc4b8c4e5eb6a81906b505
SHA1 50329b3a21759e0477e6f8ae9d57c13bfc5dc1f3
SHA256 5eac9876ce7db89a7caf2d5743f094a4f89696ec5448b5d418d8b8549d31771b
SHA512 f5571392b4efc83f45f048d88954a46517ed99da44f69e3bd81867f2b463213fbd0766c370cbf821ae64abb77676a0331e5b51b84b6b94d6b8023d6cc2e4c19f

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 eff59d9177c314e081b4210460ac3bc5
SHA1 a7086682e9237ac5ab808316301c9bd1283f17c3
SHA256 152981ded86e7df909746b4689edc1a3c4bd44058b1cd2c3de9afd1bce8a2dc7
SHA512 4e351454e12b5aba658696f517464410b2c69ca27e552397fb754402133fcf0778b525263afec7258429366510553cf8a56d95be708eda1c3d17a99d39c93177

C:\Users\Admin\AppData\Roaming\EditSplit.doc.exe

MD5 d408363dfb622d04a2af9a0094179384
SHA1 521ef1852610377375e6be8caa68755596b16204
SHA256 24973d712a0e902c287d47e0571a5d0eada8ad7863f587666d6d753b694a6302
SHA512 deea8e366b2d03b61a2c5def7f045bad258cc1951abef7b7ebd51e4bb4f960c37989fdefd1e65016a1f8ef0bc833f426c7682716e672a0f187d65c23ddd3bede

C:\Users\Admin\Desktop\UseEdit.doc.exe

MD5 c6d9d83cb39d91a65b7dee35a1f08cd7
SHA1 218c78e80eeb4db007f9b246effdb72723685f64
SHA256 8e83342a5ecea284c710faf6e86c3e4477ad9f87e0f90ea7f48a699dbb2842ef
SHA512 509d31d8890d92b84231fcb517f313346ff8d8c5f3faedd89d05277b031ab924b571ce4366b73b0a46f46fe5837d125fb9a67eb27d7118220b55792012877152

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 f0e29495d70d1402c41217a2d85fbe59
SHA1 931bff1279c07637ceb3e1a1d6e5edce83bad82d
SHA256 28cac614ca8c0edeb2433744820f4b0729329c711edd1d41d3a7c94b8e6520b5
SHA512 354261ee0c1012fabbce84d3018d4875667352d64e102fa1b9d568b9e8f0fb590de2a0909e13e8df46b862ada3f3acd9a7b4b5caea6bb8dd16aa15ea5011e43e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 0a3443ed2a6e22c6e64699121d176eac
SHA1 e207b038127acdd8bff0fb2fe0b9227a01948056
SHA256 70b19f7538904fa274eb855ded00535b3ae87bba372121454961cbdbbe54f519
SHA512 1f57016810bbf3fe7b02b7331e5d14524a06621fc126a4dc84e4d011bd20857226db7b47a173d4febb4f0a897e49ae8acb5506730778f298ea156219dbaa8436

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 893d712ab56c908422ee753d91f475fc
SHA1 44f868b5d305d553b0974abe9b7f1b89bf965fb5
SHA256 fed6e868de078ec9fb63f574c07f6d9a972756a2ac35d28ad5c3d010a45e5a8b
SHA512 f55a852271ab345f1d5d511efcc620d2e093ff1877ef6c4554f0df5a4056f99ee92ad161a3d2ed371cc8c9ac3f6c58f157e413edb417166c36123b1e346b9629

C:\Users\Admin\AppData\Local\Temp\TCDC335.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 2b0f8c2878bf798e0176d6d182b3cb3e
SHA1 7fe0794d2095ca737c86359923a9c00e7e42ff5e
SHA256 82005c03d13e46a3e9680de5adf5bb2af153774c109fb4b19fb33f0cad844c46
SHA512 58ab7852cc8a26c18af73f62ccf0cc1d4140b293773b67739d795993800e1d15601fa13e3bb8d979462c988024b281cea84c271d0a0451ba5543bffbcfaacf84

memory/1192-606-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-605-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-608-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp

memory/1192-607-0x00007FFD60FF0000-0x00007FFD61000000-memory.dmp