Malware Analysis Report

2024-11-16 10:44

Sample ID 240603-mfylaace23
Target 91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118
SHA256 09a8214f7ad3930caebcd0322f8a37f4bb6729fbfdd6151ff98917ae87117c05
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09a8214f7ad3930caebcd0322f8a37f4bb6729fbfdd6151ff98917ae87117c05

Threat Level: Known bad

The file 91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Executes dropped EXE

Checks computer location settings

Windows security modification

Reads user/profile data of web browsers

Loads dropped DLL

Enumerates connected drives

Adds Run key to start application

Modifies WinLogon

AutoIT Executable

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 10:25

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 10:25

Reported

2024-06-03 10:27

Platform

win7-20231129-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dpxkuckx = "uajrvgsooo.exe" C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lswatfqb = "nfupbvrxmosjfpe.exe" C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cwrhnxnwbmjio.exe" C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\r: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ndezggag.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ndezggag.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\uajrvgsooo.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\uajrvgsooo.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ndezggag.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\uajrvgsooo.exe N/A
File created C:\Windows\SysWOW64\uajrvgsooo.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ndezggag.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cwrhnxnwbmjio.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\cwrhnxnwbmjio.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\SuspendCompare.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files\SuspendCompare.doc.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files\SuspendCompare.doc.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files\SuspendCompare.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files\SuspendCompare.doc.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files\SuspendCompare.doc.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File created \??\c:\Program Files\SuspendCompare.doc.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ndezggag.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ndezggag.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFAC9FE13F299830B3A4781993E99B0F902FB42120333E1C8459908D6" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\uajrvgsooo.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC70B14E5DAC5B9C07CE2EC9F34CB" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\uajrvgsooo.exe N/A
N/A N/A C:\Windows\SysWOW64\uajrvgsooo.exe N/A
N/A N/A C:\Windows\SysWOW64\uajrvgsooo.exe N/A
N/A N/A C:\Windows\SysWOW64\uajrvgsooo.exe N/A
N/A N/A C:\Windows\SysWOW64\uajrvgsooo.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\ndezggag.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\cwrhnxnwbmjio.exe N/A
N/A N/A C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uajrvgsooo.exe
PID 836 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uajrvgsooo.exe
PID 836 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uajrvgsooo.exe
PID 836 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uajrvgsooo.exe
PID 836 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe
PID 836 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe
PID 836 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe
PID 836 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe
PID 836 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\ndezggag.exe
PID 836 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\ndezggag.exe
PID 836 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\ndezggag.exe
PID 836 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\ndezggag.exe
PID 836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\cwrhnxnwbmjio.exe
PID 836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\cwrhnxnwbmjio.exe
PID 836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\cwrhnxnwbmjio.exe
PID 836 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\cwrhnxnwbmjio.exe
PID 2544 wrote to memory of 2732 N/A C:\Windows\SysWOW64\uajrvgsooo.exe C:\Windows\SysWOW64\ndezggag.exe
PID 2544 wrote to memory of 2732 N/A C:\Windows\SysWOW64\uajrvgsooo.exe C:\Windows\SysWOW64\ndezggag.exe
PID 2544 wrote to memory of 2732 N/A C:\Windows\SysWOW64\uajrvgsooo.exe C:\Windows\SysWOW64\ndezggag.exe
PID 2544 wrote to memory of 2732 N/A C:\Windows\SysWOW64\uajrvgsooo.exe C:\Windows\SysWOW64\ndezggag.exe
PID 836 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 836 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 836 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 836 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 940 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 940 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 940 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 940 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe"

C:\Windows\SysWOW64\uajrvgsooo.exe

uajrvgsooo.exe

C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe

nfupbvrxmosjfpe.exe

C:\Windows\SysWOW64\ndezggag.exe

ndezggag.exe

C:\Windows\SysWOW64\cwrhnxnwbmjio.exe

cwrhnxnwbmjio.exe

C:\Windows\SysWOW64\ndezggag.exe

C:\Windows\system32\ndezggag.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/836-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\nfupbvrxmosjfpe.exe

MD5 a50e15802c503c2bd61a28170553088f
SHA1 d1cf4ff6b199f998ae5ab1769f3a6f27e635e990
SHA256 d558d6c1fbd3277f48c382a2e55c339048593ad5f00e3a1c0a009108a3babe34
SHA512 92ad118221a1029c05a9293cab3a368febd3192c38b4a1d2abbad5a595912448f3ac8baf125c503946031d898d92a4e89f95227722ea6e9e8d389d4c1a62c8f3

\Windows\SysWOW64\uajrvgsooo.exe

MD5 5ddf1302126b95838422d027ad1f685a
SHA1 ec6d1331a289aa812720beee677f41e61c9c2fbc
SHA256 1563ebcdbff2b4f3329fdcab8364c0b2e4044af51dda2af16e061ef1dedda8f0
SHA512 9f5b04e07e188165b0128999c89a0e2265bfd0ceeaaada7acd59b63e44d4755e1e4b89d0df48b16fe8937ad3a9b2a8d0cf430b079f7055b92107f5a2d4ec2046

\Windows\SysWOW64\ndezggag.exe

MD5 ff124479c82d5387afea98ea0dc71f4e
SHA1 35993efdf1d0a959a6e601ade3eb74621d9e064f
SHA256 012b66335f4d1c4d2d23b4363bcc26b12c98bc43621980160384f99fc1f92be3
SHA512 340b732fad39aa21f6244475fd8158108a74ee206bd3521e514d3590577de251d1fff4dabc94eda66c2f2563df81a894257a8be8d4ff713c33e4a3ecda2bf2a8

\Windows\SysWOW64\cwrhnxnwbmjio.exe

MD5 f7c2addcb125ca56470e02119b652ee8
SHA1 ef5ab4c0858a3f39115503f134d7ebf042dde3fa
SHA256 44d019f9082457c59f763211221a92723296782904facd6c3c4e97e813d447fb
SHA512 9d655c15c0566859646434b21ac4f4b58988e51c846aa1cf9b90e4eca2d0ceec1dd4b27f82e6d03ab1ec8548fe992e7d2be3372e4561c6b9c892bb03435b3901

memory/940-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 a5ec360d2881711e86052f61fafdb59f
SHA1 220774f470b5b10058869d49a795f929415cdb2a
SHA256 141a57d6c7b0b91fefe12329bca2c4f5f65e21fa0fe3b3c1bb212e7a3bebaa37
SHA512 55863a09cf13705c508d3d7f9273716675f06f5bb6b87148f7bdfe25c8734a3ce69bd43a50a6d4d5a37d1d4074309ee93d84d53f284a7a3a5e8fc3457296ceb2

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 23411aab46d0c8da5c7cbecf07226b20
SHA1 1e9c219001dd8a25ac199c2c60dbdbeae4a49a0c
SHA256 7bc070ab063d46f03001626e52ed7a1b501a002282578ae1b3fd82da58b757fb
SHA512 9ef0eb5956a8fa98e18807ea120202f1602298df2d817de4c99b7b6d5f1fd9bdc48aa2cde2aaf81d0e1b4d61e36a6c786504525550f264578c686ac16e61d62c

memory/940-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 10:25

Reported

2024-06-03 10:27

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wtwnmcty = "lpfcqcmnem.exe" C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hjevsxhk = "jcrdxmgazuzgkhc.exe" C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lhjavrmvuarni.exe" C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\u: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\uohweqdz.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\lpfcqcmnem.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created C:\Windows\SysWOW64\lhjavrmvuarni.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\lpfcqcmnem.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created C:\Windows\SysWOW64\uohweqdz.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\uohweqdz.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\lhjavrmvuarni.exe C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\uohweqdz.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\uohweqdz.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334F2D789C5683256D4676D370542CA97DF464AF" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFFACEFE16F1E284783B35869C3990B3FC03F14262033EE1C542E808A9" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B15A47E6389E53CBB9D332EAD4CC" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFF8F482A85699045D65A7DE7BC92E637594666456330D79D" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C67B15E7DBC4B9BE7F95ED9634BB" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F668B1FF1A21ADD27DD0D48B7D9063" C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\lpfcqcmnem.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\lpfcqcmnem.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\lhjavrmvuarni.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A
N/A N/A C:\Windows\SysWOW64\uohweqdz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lpfcqcmnem.exe
PID 4808 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lpfcqcmnem.exe
PID 4808 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lpfcqcmnem.exe
PID 4808 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe
PID 4808 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe
PID 4808 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe
PID 4808 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uohweqdz.exe
PID 4808 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uohweqdz.exe
PID 4808 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\uohweqdz.exe
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lhjavrmvuarni.exe
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lhjavrmvuarni.exe
PID 4808 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Windows\SysWOW64\lhjavrmvuarni.exe
PID 4808 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4808 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 548 wrote to memory of 3348 N/A C:\Windows\SysWOW64\lpfcqcmnem.exe C:\Windows\SysWOW64\uohweqdz.exe
PID 548 wrote to memory of 3348 N/A C:\Windows\SysWOW64\lpfcqcmnem.exe C:\Windows\SysWOW64\uohweqdz.exe
PID 548 wrote to memory of 3348 N/A C:\Windows\SysWOW64\lpfcqcmnem.exe C:\Windows\SysWOW64\uohweqdz.exe

Processes

C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\91707fac8a248816ce96e2c7f5fe6719_JaffaCakes118.exe"

C:\Windows\SysWOW64\lpfcqcmnem.exe

lpfcqcmnem.exe

C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe

jcrdxmgazuzgkhc.exe

C:\Windows\SysWOW64\uohweqdz.exe

uohweqdz.exe

C:\Windows\SysWOW64\lhjavrmvuarni.exe

lhjavrmvuarni.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\uohweqdz.exe

C:\Windows\system32\uohweqdz.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 23.251.17.2.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4808-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe

MD5 91707fac8a248816ce96e2c7f5fe6719
SHA1 7a8d2f1e21478d979ecd3e8b24166c1ed64c1625
SHA256 09a8214f7ad3930caebcd0322f8a37f4bb6729fbfdd6151ff98917ae87117c05
SHA512 cea3409365a58dbdb3dc1b1cb0f01f065285e967c3897cf555bdacb4817f2b7b56683fdecd02e5d8347a1b5a1d65bc12a611d6c4758840b2893e02e55b690ec6

C:\Windows\SysWOW64\lpfcqcmnem.exe

MD5 8e45080fc089b460bb860bb9b1bdbdaa
SHA1 20c61328dbfae7d9eda0fac1a1767513470dc750
SHA256 ff90b06913c566889a9f7d9bdd86b7cc791c77a628f85bb69ab4af2dba1ebec4
SHA512 39b461626e22312365e2c03881e77324b103f7af64097fe1e2c48939fdea34f225ba2556e1eef4e2795309258d834cbfd33b5b191b2ddba0177a1bc1730dca7f

C:\Windows\SysWOW64\uohweqdz.exe

MD5 ac52c5a63d29ba6dc6fd4a2d3d82b37c
SHA1 e2b9e75b4f9bc1b83293b6479ac7e3945bb6b90b
SHA256 db36dd570c368b9856f46abede42e975517bbfd980a13adc2bc2dac579d11cb4
SHA512 5e5463c3436a42c89b8a1c8e5db22757a0d2175ac67ce38e32c47eaa849cab9d8c446d68a7f6888b69bef5d05563bc68f2c47cab8c4394736a6e30229c7af1d9

C:\Windows\SysWOW64\lhjavrmvuarni.exe

MD5 1a578ca19e2270560a4576c013ae7426
SHA1 d17cb677afb31641c56599ebfdffae5e868d6c1f
SHA256 e7f0ca41d8182cd7359fda3d0ad1f2fe4c9d6fbe2a2a8c7de52e9c9c713f9140
SHA512 cd4026c69135d09c68c9cfedba5dce48c8ef3c1b03a7720ce3b001ce7d3cab2c99d9cb5ae4630f9ef42e5ea17a147ee850becf5836b953afe91c40b203fabd45

C:\Windows\SysWOW64\jcrdxmgazuzgkhc.exe

MD5 45619a3f44cb17e27dc9885c3f65b4f1
SHA1 4df67d3ab6ba6c10640bfe1ff4c7f99e54958d7d
SHA256 32f80847efe5775a45c697855fd92e4432505dd6efb05f2239d14d4c08c4eb16
SHA512 0d67973553f145c3a7b66c8e44f40e247c9d82f156efc1d016c85996604b50745080b055adbbc052d2ee592e7ee1e61b30267042455562cee68eff5be3715081

memory/4628-35-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-36-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-37-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-38-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-39-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-40-0x00007FFFB4CC0000-0x00007FFFB4CD0000-memory.dmp

memory/4628-43-0x00007FFFB4CC0000-0x00007FFFB4CD0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 c45925b720c576b45c0cf7db53ef502c
SHA1 9d4aee820651f77a8b1753e380dd9636f4eed9f4
SHA256 f4721ff39003ea4c92711479d12a65d906288bda6faad85f23abfc5b6bf047dc
SHA512 77490162533352efa48d9a371feb5f74816024a101b4970aa3d674b6e7115f5b540ba3b438596f4c6f8e82208a5b4f9e0808b05320e55a916b5641ce2c33c9c4

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 8fcbb06e694d87ec8e4607ab20541db0
SHA1 4c0f7db02a137aa78681733c2a10ca2cce83b090
SHA256 5fa39fbd6c0de141fd66018b98440f008a38b3258a179efb552eb18e377f2214
SHA512 765e0c8aa90e8307af2a6ef5a63db28ad14ebf29f7f45c1006deec9a90e967723b1e88ab2db3188a04180ac175302d93e61a9b71164c5ce586f17138df38d5b1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 98b33c4db536d1b54ab1ae0cc204b42c
SHA1 016ac8c40b4e809046268db9611b621e4129caee
SHA256 6c9e71ee6686a42266a2e5ee4d35290e7e6468f1441e817bbe5e36266f0fd9bb
SHA512 f34e515fca6aed767d638c0f3a5e8bb0c30184222ede5dec1661f82148accef19b82b9fcf90026109138ff0b71ec3407c65fb481e648d8d356ba301c06f575e1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 a95fe26571fd4f83376d498df6b6538e
SHA1 421f9e00e22ce8406ab9eb915477055ba0d4b1b9
SHA256 d58414386eb5026c32d64f6a95fa0b27c94a9146839b6cb1b7d93ca207f95d8e
SHA512 2644ee2b0a08fe8d53303c421643ccd078e0e981b783c618be3330ba0b47f66558ed0be478e326a2a754c19c7b1053cf46d0b72fb69a76be92bdd8741eb42193

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 91571bdc740477bebf622bbe39d066c7
SHA1 ab965e4f0b3ab9d6ff1cd4bd66372331449b3746
SHA256 05a161e952b6506da5122e31caff00eb1d66362b902f2b3b241c4132042c5104
SHA512 4cfd64e81e278ae5c66075aacab0862ddac49a8e0577e1ae09435ca1d6f0e96834472bd2017fe85ebbf090f04f2a3f4a67f52b9159cca8f450384c58ae35385f

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 d639b9bd7f02bc790acac3c04a13f062
SHA1 265a8015cd46c0a6ee70a85006905b29d8b4bc90
SHA256 1c8176ca786430b57921e40eabd93dc500befb49cd6e59bb7665fd76fe088803
SHA512 c46a52f0bfc38133a7236e93775c80a075a2dfcef5529656e54b661b66b977d3754af493afe622b8356e2b5b98814f6913f01a8d7f1c9699b3f069979081362a

C:\Users\Admin\AppData\Local\Temp\TCDC9BA.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

memory/4628-598-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-600-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-599-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp

memory/4628-597-0x00007FFFB6DB0000-0x00007FFFB6DC0000-memory.dmp