Malware Analysis Report

2024-11-30 06:13

Sample ID 240612-r1mrqssdml
Target a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118
SHA256 54db138b93c04007d14819a05dd722197078da1ff3caa439d3c922aa0be26b0d
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

54db138b93c04007d14819a05dd722197078da1ff3caa439d3c922aa0be26b0d

Threat Level: Known bad

The file a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Modifies Installed Components in the registry

Executes dropped EXE

Reads user/profile data of web browsers

Windows security modification

Checks computer location settings

Loads dropped DLL

Enumerates connected drives

Modifies WinLogon

Adds Run key to start application

AutoIT Executable

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 14:39

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 14:39

Reported

2024-06-12 14:42

Platform

win7-20240221-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\qopnedebvy.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\qopnedebvy.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hdcmykmx = "qopnedebvy.exe" C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cdcqlodd = "wihhwgwrzsolwzu.exe" C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ksnqhdpgawdon.exe" C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\p: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\qopnedebvy.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hwypuuwh.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\qopnedebvy.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hwypuuwh.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hwypuuwh.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ksnqhdpgawdon.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\qopnedebvy.exe N/A
File created C:\Windows\SysWOW64\qopnedebvy.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ksnqhdpgawdon.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\qopnedebvy.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hwypuuwh.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\hwypuuwh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\hwypuuwh.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C779D5083516A4276D470232CDC7CF165AB" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC3B02D44E738E252CBB9D73392D7CE" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\qopnedebvy.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\qopnedebvy.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\qopnedebvy.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\qopnedebvy.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\hwypuuwh.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\SysWOW64\ksnqhdpgawdon.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qopnedebvy.exe
PID 2172 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qopnedebvy.exe
PID 2172 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qopnedebvy.exe
PID 2172 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qopnedebvy.exe
PID 2172 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe
PID 2172 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe
PID 2172 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe
PID 2172 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe
PID 2172 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2172 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2172 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2172 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2172 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\ksnqhdpgawdon.exe
PID 2172 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\ksnqhdpgawdon.exe
PID 2172 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\ksnqhdpgawdon.exe
PID 2172 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\ksnqhdpgawdon.exe
PID 2604 wrote to memory of 2392 N/A C:\Windows\SysWOW64\qopnedebvy.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2604 wrote to memory of 2392 N/A C:\Windows\SysWOW64\qopnedebvy.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2604 wrote to memory of 2392 N/A C:\Windows\SysWOW64\qopnedebvy.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2604 wrote to memory of 2392 N/A C:\Windows\SysWOW64\qopnedebvy.exe C:\Windows\SysWOW64\hwypuuwh.exe
PID 2172 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2172 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2172 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2172 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe"

C:\Windows\SysWOW64\qopnedebvy.exe

qopnedebvy.exe

C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe

wihhwgwrzsolwzu.exe

C:\Windows\SysWOW64\hwypuuwh.exe

hwypuuwh.exe

C:\Windows\SysWOW64\ksnqhdpgawdon.exe

ksnqhdpgawdon.exe

C:\Windows\SysWOW64\hwypuuwh.exe

C:\Windows\system32\hwypuuwh.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\explorer.exe

explorer.exe

Network

N/A

Files

memory/2172-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\wihhwgwrzsolwzu.exe

MD5 63f69313426027bba98a5eecbf0a9e24
SHA1 85f7eb3721337933b9005f8d48ba40cba764644c
SHA256 c80ebdd37e4feab27fa5cc120040f4eb66bc36ec09649df3133a107ff11f5e2e
SHA512 3875bd735ef619cd40eae64ed920fcf401a3d71149774b9211863a9e09d5f29f9830430759c1c57e9f6a1f8349ed36e71624fdde5c0b59afc88c42d8ce8cb71e

\Windows\SysWOW64\qopnedebvy.exe

MD5 2f42a34f52f7dd2919de5bbab2b7ff0d
SHA1 511ca480ddee18f2c38c2f4bb219dcd47998ed13
SHA256 a75e20ad1e1b4685eccf5833209fb7f5300a9199da7751b133ae4d84d4a21111
SHA512 71b776a7f00aff92d031c79b79bac50ee1542384f80f4fcbaa6bac39efd9871cc0c97443b79909563b49b550cb6c88d384cf798fa5b3899611858a46636530e5

\Windows\SysWOW64\hwypuuwh.exe

MD5 d39ef5beb414e36b4742651add61131c
SHA1 99c279efe42978d93c2cc86e748c3b9606af5720
SHA256 31459c9e98a7a72e2d004834a9ad569c98da658e407fc1cb6688b5988d06c609
SHA512 e523c33b4fc40813ffc03e2c0c3d2d396e04ed36eaf0bb4c740994d94f7d27d74f9f688bb2a82fe38d5b70566d18efb9bff12de6db1b125ddcc300aaf2f0580e

C:\Windows\SysWOW64\ksnqhdpgawdon.exe

MD5 f442f5cb19091a77979508618bebe742
SHA1 bd47de332a03bdd10d35a59c7a6252bdb953987c
SHA256 75a6a554074ffb14437eeb41dabac8e994c249ecd1e643dd6d81e388c9e65cf4
SHA512 fa620498f753db159cdc2467b5f3e41d756aedc2f5b8874c5666108abccfe668d97f0c18327c1df99080baa57e850bfea4c3d41efb200677612cca00665c0c94

memory/1632-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 7aa2a2fc9487368d2250a864a3c4acf8
SHA1 b34ae1b6c41c38839ba06fe3627516460d8bc793
SHA256 15340e61e69685c523fdc7af71c3441dbe8540286fc1463de1016c920077a8cb
SHA512 98ed8e4bcbe0b87b74349cf176ffe9e42ae48dd7d101c905c4da7375d1a8d92b8298f64d82778fb03e832e38bb23295495ec3b7117d764e352036d01eceee0ac

memory/1736-86-0x0000000002A00000-0x0000000002A10000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 14:39

Reported

2024-06-12 14:42

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\qbzenfernf.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\qbzenfernf.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tmimiyga = "qbzenfernf.exe" C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtenytak = "lalmyvlffhltxbu.exe" C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tbnhksyjmdxla.exe" C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\qbzenfernf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\qbzenfernf.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\qbzenfernf.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\qbzenfernf.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Windows\SysWOW64\lalmyvlffhltxbu.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\tbnhksyjmdxla.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created C:\Windows\SysWOW64\lalmyvlffhltxbu.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tbnhksyjmdxla.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\qbzenfernf.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created C:\Windows\SysWOW64\qbzenfernf.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\bpahfuog.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bpahfuog.exe C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bpahfuog.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bpahfuog.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9FACCF961F19484793A4786973997B08902FC4364023DE2BD429B09D6" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC77515E7DAB5B9CD7FE0ED9F34BB" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B02A47EF39EA53C8B9D7329AD7BE" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FFFC482E85199133D65D7E9CBDE7E1445943664F6332D7EC" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C7A9D2383236A3276D670232DDC7D8064DF" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F56BB8FE6D21ACD279D1A78A7E916B" C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\qbzenfernf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\qbzenfernf.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\qbzenfernf.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\tbnhksyjmdxla.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\lalmyvlffhltxbu.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A
N/A N/A C:\Windows\SysWOW64\bpahfuog.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qbzenfernf.exe
PID 228 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qbzenfernf.exe
PID 228 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\qbzenfernf.exe
PID 228 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\lalmyvlffhltxbu.exe
PID 228 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\lalmyvlffhltxbu.exe
PID 228 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\lalmyvlffhltxbu.exe
PID 228 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 228 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 228 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 228 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\tbnhksyjmdxla.exe
PID 228 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\tbnhksyjmdxla.exe
PID 228 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Windows\SysWOW64\tbnhksyjmdxla.exe
PID 2576 wrote to memory of 4216 N/A C:\Windows\SysWOW64\qbzenfernf.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 2576 wrote to memory of 4216 N/A C:\Windows\SysWOW64\qbzenfernf.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 2576 wrote to memory of 4216 N/A C:\Windows\SysWOW64\qbzenfernf.exe C:\Windows\SysWOW64\bpahfuog.exe
PID 228 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 228 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a10549e7777d1a9add527a4b8531ca5a_JaffaCakes118.exe"

C:\Windows\SysWOW64\qbzenfernf.exe

qbzenfernf.exe

C:\Windows\SysWOW64\lalmyvlffhltxbu.exe

lalmyvlffhltxbu.exe

C:\Windows\SysWOW64\bpahfuog.exe

bpahfuog.exe

C:\Windows\SysWOW64\tbnhksyjmdxla.exe

tbnhksyjmdxla.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\bpahfuog.exe

C:\Windows\system32\bpahfuog.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
US 8.8.8.8:53 roaming.officeapps.live.com udp

Files

memory/228-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\lalmyvlffhltxbu.exe

MD5 4d9f4a90181db112e32e8b8f63b45d5b
SHA1 7c6a1a964fa80a184cb8c8faf756113530e7361d
SHA256 4bbab7258bd8f6117a8a8403ffa10cd1e85510c0578262c8d2aa75a02398e925
SHA512 9b8513a478a3497422688722892b61eebcb6943c53e2291a212b67205cb34f155bda77ab8a7510e930c4fe19ed2b2cb0a52d323a3dbc47e2858e4f07ab1d9371

C:\Windows\SysWOW64\qbzenfernf.exe

MD5 3da3750e0999ce24587fd4a97b2ce98e
SHA1 dc6041a8ef7bab2decfbfcf2be17ef6a9d63180c
SHA256 0bb80c68e5da7caa293a2555e5c2338617a45c818307c724ceeac1f778c28fe5
SHA512 e73c641143ceafe9b17a93569e1a46b78ec0384e2f5d900c6a95945847ef5eccb62b354f2296e1cb3d683e741d152c0eac61bed0dadfe9ea0edcb26365c10807

C:\Windows\SysWOW64\bpahfuog.exe

MD5 87c818c01c86b054887c238b1e13dbaa
SHA1 e80f5398d4c8b16dcc12935745e8a07981e43f7b
SHA256 2c78d3cc0c5fccc4818ab5935c36c3bf67b02aa24beb9e87890a0d9ad2c392f0
SHA512 81cfcd7231badb85f612aefa4ae5d523e9620a1a1913a4e498cadb854b86d84572be50064618564a2843a26d2581d9322ba00bc1c32c77496ccdbcf97de5a546

C:\Windows\SysWOW64\tbnhksyjmdxla.exe

MD5 926242d4f84490ce0ad2dbaf8f49687d
SHA1 20c2f7371da4cda50ee4403ab55147b4ebd4c1c7
SHA256 dca63252433557cfe2fae26c1f48d2aa581bbd76b636a76eb21299e3b8846b2f
SHA512 1d1a8b479055b1d18589b9504b974c2647584b42bb483d762bce81378984af0f06edd943a8025b1ccc6a06b38fe4e65ef64e0be3f0062ad246cb7678065f2183

memory/2420-37-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-38-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-39-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-40-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-41-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-42-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

memory/2420-43-0x00007FF88CF70000-0x00007FF88CF80000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 d155735cbc3f25382097e90d328c8df9
SHA1 b707ba2b709d3f8f59e3e870b74e19818bf7c35a
SHA256 a26457d28b8814ae075049f4bf0eac1af3d41085b5c67ba6433053dc32d157c5
SHA512 a61b87f743fa70386b372a4df4178c86fce467ba123ac4cad46f3cd25a6620f5e47387fb475af331fea081015b8a00b201658220fab4799e4745fc92e043024f

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 a540969a3370cae830603aa080ec69cd
SHA1 d73e002f7d9a9989a5fd3f1de3afe32785f34178
SHA256 0f1368c9b233346c891338ca881172fe0dd1871cc8ba686a4e6e6d067af14052
SHA512 cef92ee8fe7ea6116f9bba636edf4485d2c33e0fad29ec94f929c3185f984a478ebf4d43510dbd8070751fd141a418dd96ad6a68c2b0e04518da1820c832dc55

C:\Users\Admin\Documents\SuspendUninstall.doc.exe

MD5 7bdd384919604600b8a38d9733ff0171
SHA1 4c1a13c274aa2e183c636ec41eae059a989d761b
SHA256 8634c9aeea4e9bb31f896437b3caeb83aa84b3ad3b685299f7a8b10661d98243
SHA512 54484fc6127b2a3a394dcfde080cd147d5752e2bbc8b8222897a54c268aaa4fffdf01fa38df59782950cd12ab205dff3125f51cf67d7a643599ff56c17be1107

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 aef3cb0b6d57bd032dd184f040279c2e
SHA1 6f437b8103c972a51c6c831b68b12563763b4845
SHA256 272a50d55a6590c056510edcc10339c8d7968e61a11bdcdbd5062dc9ab852236
SHA512 1804c5dd6423b0178af23eb12cae5a850cf33de318c18369442f3c0f3b435e377c568e282d3f343cd58527176ca638aa695377f30319cc61a78a7af6c19fdcaa

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 6424b221662a11aecf8672b09d86cfde
SHA1 866254727ac0444aff5fe74742b1f4fc9e754ed9
SHA256 dbd3f0c82d3d6cd46aee7989a4a85fc24e8d795107a37dadb09ba490064332ea
SHA512 c2389fd564e9291806d9217fa5252fb68e769e58f7cdda7ca7d41d02da84fff727e1ba2ae6765a847f051b86d7899c5721a50a92fa138b085ea04ccb2ad22d7e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RFe57831a.TMP

MD5 f3f79fbc505ba7ea2bd84fccbe2d5d25
SHA1 9296fdf7a3d6ddd1d836a191a7f849886af1510a
SHA256 a3fe4877352e7c92eec07a26683e289f92cfaeda3c062e5ff76302e4bd6689dd
SHA512 6c84ef0fdc08ce36e56fc39abf8b36fe813d16ae1912edb7d0d14281df20492d463d73e655f3df3c8821f19e3620c40722bd843f3269aa8ee4813999b95551ef

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 20b8f3fb8b4ac7fba04b9cad64515004
SHA1 eb557e0e0388ed6edf4395b28c017a600a4f2824
SHA256 efbbdd54e642800a935c055bc024e7c9fb5fe32e10ed2e1a361dad1a679ec944
SHA512 85dd8339bbdf10485ec01ed005aedd4e13c963eb4a3d2cbbb373bd252883c761b71d5db0de07c49b042efb343b94ad34e3ddd5820263b5084c6db7c5f610a28b

memory/2420-126-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-125-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-124-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp

memory/2420-123-0x00007FF88F8D0000-0x00007FF88F8E0000-memory.dmp