Malware Analysis Report

2024-09-11 13:17

Sample ID 240613-3dyfhavfjb
Target a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118
SHA256 2488e1f3f2c8b81d3a14750f68b3c770dd7cb3275f31f8968dca800bd6f5fa23
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2488e1f3f2c8b81d3a14750f68b3c770dd7cb3275f31f8968dca800bd6f5fa23

Threat Level: Known bad

The file a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Windows security modification

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

Drops file in System32 directory

AutoIT Executable

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:24

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:24

Reported

2024-06-13 23:27

Platform

win7-20240221-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nzingmyc = "rfvaetyjva.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zknffohb = "crgdemnjgnrxpfq.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tpjdfqokzfnmq.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\b: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\kvylypar.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rfvaetyjva.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\tpjdfqokzfnmq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tpjdfqokzfnmq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened for modification C:\Windows\SysWOW64\rfvaetyjva.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\kvylypar.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\kvylypar.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\kvylypar.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412C7E9D5683276A4277D4772F2CAD7CF164D8" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "194AC67A15ECDAC4B8B97C90ED9634CB" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78468C6FE6D21ADD20ED0A38B099110" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FCFE482A856E9145D65F7DE1BDE6E641594167326333D6EC" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 2324 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 2324 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 2324 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 2324 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 2324 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 2324 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 2324 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 2324 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2324 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2324 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2324 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2324 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2324 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2324 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2324 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2716 wrote to memory of 2464 N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2464 N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2464 N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2464 N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2464 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 2636 wrote to memory of 2436 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2636 wrote to memory of 2436 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2636 wrote to memory of 2436 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2636 wrote to memory of 2436 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 2324 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2324 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2324 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2324 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1668 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1668 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1668 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1668 wrote to memory of 2132 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe"

C:\Windows\SysWOW64\rfvaetyjva.exe

rfvaetyjva.exe

C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe

crgdemnjgnrxpfq.exe

C:\Windows\SysWOW64\kvylypar.exe

kvylypar.exe

C:\Windows\SysWOW64\tpjdfqokzfnmq.exe

tpjdfqokzfnmq.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c tpjdfqokzfnmq.exe

C:\Windows\SysWOW64\kvylypar.exe

C:\Windows\system32\kvylypar.exe

C:\Windows\SysWOW64\tpjdfqokzfnmq.exe

tpjdfqokzfnmq.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2324-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe

MD5 19b08b9637625217718bc524cb64d337
SHA1 b04dd0fd9e95b0bc3705cfd9ac723ccdcb0eb37d
SHA256 62ecef05535591e54acd11ab40d0114b9999fb53339d640733256a00d78484b7
SHA512 f0106119d6d29ba5169cef5bf028ccceda89f0eb0cc9ad44e193d8f036ca7960aed570c907c1fc87d65e47eed522a4a87ceeacef9b3d742817549041eebbd94c

\Windows\SysWOW64\rfvaetyjva.exe

MD5 1caed5bb10a28b2f6db4264d79c53fe3
SHA1 34f98f790ded81e8cc59eed583a630fabbd822be
SHA256 b68629e593a29c38eea8984bc65c7ddfa086d90fba9539256db4188e5774fa31
SHA512 741e05651ecf3674e7a2a57bd0f55556957c7316d2bf4f2e4b50411aac21261589519061da837210b2274cb8fc7290b68c5582fe404f96391e89bda76c5ec3d5

\Windows\SysWOW64\kvylypar.exe

MD5 41c0f1b46e66de3a67321feb92887adf
SHA1 e4fb9e1d3537edadb0331506e4961b1f0790b328
SHA256 c53b9dd258ffdcbeed7cb8b6cc5f3a1062b875b59d06295774b333361c98a457
SHA512 01af7fe9e822035b61326367dd8e57a87c204ce3bc2beb633eaaf840e5f6c264ce91b507e65d1c62ee4fdcebb27b4d1ec2552a701bd6faa034db63fb0f6b1566

\Windows\SysWOW64\tpjdfqokzfnmq.exe

MD5 bd6908cdb0078435d25610b2dd950976
SHA1 14a3c348149ce5d25fcccd2e8252e54f1a28cb4c
SHA256 a28891b3647701c41bb8cd365b247913b4f5860a274d694ea8224c9ef9a0edd5
SHA512 f9632a1950ee5055bbf17811eede8d2dbf5c2b20484ec64193d259900317be4193447996872f85eaf42c55b6dccf1d2e0dee074f8a479967d74373d7645d8ec9

memory/1668-48-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 2d77568d5256cc036aa4882abbdc45b5
SHA1 94defb562c4e3d40b9ea31825d67a29f951d4e44
SHA256 f8e2434c6ab5c47d2a007397be71a23e9e49164f2fac6391fc2ba8420deb3d59
SHA512 8b20a25cf39e61e678a5a25e0b4706f727e4f5a40304ae009be31e8af5a62e80c31ade4d130e20619fb7dadc1c776a530171c311cda9aaccd48b66a7b1f12694

memory/1668-99-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:24

Reported

2024-06-13 23:27

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nzingmyc = "rfvaetyjva.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zknffohb = "crgdemnjgnrxpfq.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tpjdfqokzfnmq.exe" C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\i: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\kvylypar.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\kvylypar.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\rfvaetyjva.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\rfvaetyjva.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Windows\SysWOW64\rfvaetyjva.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\kvylypar.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created C:\Windows\SysWOW64\rfvaetyjva.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\tpjdfqokzfnmq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tpjdfqokzfnmq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\kvylypar.exe C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\kvylypar.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\kvylypar.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78468C6FE6D21ADD20ED0A38B099110" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDF9CDF96AF1E283753B3586EE39E2B08802FA42110248E2CE42E609D2" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "194AC67A15ECDAC4B8B97C90ED9634CB" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC0B02C44E739EE52BEB9D232EDD4C4" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FCFE482A856E9145D65F7DE1BDE6E641594167326333D6EC" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\rfvaetyjva.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412C7E9D5683276A4277D4772F2CAD7CF164D8" C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\rfvaetyjva.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\tpjdfqokzfnmq.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A
N/A N/A C:\Windows\SysWOW64\kvylypar.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 468 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 468 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 468 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\rfvaetyjva.exe
PID 468 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 468 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 468 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe
PID 468 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 468 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 468 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\kvylypar.exe
PID 468 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 468 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 468 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Windows\SysWOW64\tpjdfqokzfnmq.exe
PID 468 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 468 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4232 wrote to memory of 5080 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 4232 wrote to memory of 5080 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe
PID 4232 wrote to memory of 5080 N/A C:\Windows\SysWOW64\rfvaetyjva.exe C:\Windows\SysWOW64\kvylypar.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a717aa2a049e77c4ed33cca0b4728707_JaffaCakes118.exe"

C:\Windows\SysWOW64\rfvaetyjva.exe

rfvaetyjva.exe

C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe

crgdemnjgnrxpfq.exe

C:\Windows\SysWOW64\kvylypar.exe

kvylypar.exe

C:\Windows\SysWOW64\tpjdfqokzfnmq.exe

tpjdfqokzfnmq.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\kvylypar.exe

C:\Windows\system32\kvylypar.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 2.17.251.23:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 23.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/468-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\crgdemnjgnrxpfq.exe

MD5 d2c2ac4c470a42253abb7ba2baebae63
SHA1 9dd3933fe19176e499c1c82b53ee021d5e269256
SHA256 a9b254691a8a40ac14436e2e8dc83f59b73d77128ca396e6db2da964abfc2739
SHA512 a129364fad259a30c10ddb7db483ac6de10ae7a9762a1a9df53e7850156580ebc98958887b23bb59014da64aa95988c9ee0a2677a302182733a3e3185c412309

C:\Windows\SysWOW64\rfvaetyjva.exe

MD5 9b5286529484bb20aefe53c359991aca
SHA1 0d0b0a0fc1e5fb4442e5614f70ff5dd3d6382523
SHA256 979133601d2c497335b65f9a93bc0850efaa1f79f2b0638e7fd3c43e75be18d9
SHA512 4125ada954f77b087b58d9b6a9ef31058af31a9338e328754766217c7ac7137dbe3f7d1a54807b52f55837869a677125ccef61e2ca879ef0ca9bc4025f352391

C:\Windows\SysWOW64\kvylypar.exe

MD5 c50ab35fe577d47c01ce40ce194c49ea
SHA1 f67ebfb802055127a9e9eee15c561aa4166511c5
SHA256 50bcc45916822ccc15a4625d6e5ca61c6032465e550bb0cc0508d8f95d9d269a
SHA512 5abd858036307b93021276f927ce18a2b0348a790915398058399e1506b23f0ecccad89514e0d0662ec789e7d67ca18abf7a2deaa4b83972967244f9c53a7249

C:\Windows\SysWOW64\tpjdfqokzfnmq.exe

MD5 f194468e71a94a510d31af0554b7081c
SHA1 1dc598d0a2aed16ed8a13597ae68f5782795057f
SHA256 a7a3cdce1699fe3a6d68ea5fd2a928f8048d9777642c3665762ab17ccca416d7
SHA512 0895c21fc6ec7acaf074946b761330c68b0ae6836eb1391dbf5c5e0c1056ff67a558c16916df635f26e1ad0a0dce275cc4806ba9de1d7b48794b45ce54ba9c6f

memory/2284-35-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-37-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-36-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-38-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-39-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-40-0x00007FFE87410000-0x00007FFE87420000-memory.dmp

memory/2284-41-0x00007FFE87410000-0x00007FFE87420000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 187ccea7a1ae7b51444320395f37444d
SHA1 97e4e6b1e32aa8b5979fc683878cc7a145dd46eb
SHA256 4b07bb90b02e2efcd2bfc3ce25b58b9b65be816e597f308a77123ebbe09e25e8
SHA512 6d77a1de3c63e3ef07fb5e241ec0b1e106184f1f36c2826a5421bdbda918532d90d0403e0296a561247e141ade37d4fb9b55059d41380a7677bb8bf6991e87fb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 2495c9dc105409b656d3ef2f5d227a94
SHA1 f48d6299d2d26587c2b292942416d898ab3db5c3
SHA256 71d2b49dcad4ff0daa593a44b541011d594982b092e7b8867d4e4e83339f2918
SHA512 ab0c71b21ddd3765980c4a3c080cad674145716dd679d761ead5a840e1453939e7a68733483a7ffc075cf06b6ade9fa5e0e70d5659a184909ab5de7591bcbfdc

C:\Users\Admin\Downloads\SetMeasure.doc.exe

MD5 afc30f23fe5805124536bc6bc39cc757
SHA1 bb04374bff5b2bed5d042d849dd36360918d85cd
SHA256 cff627c67994960b03c49d2b5b924b29b070616bb80fff2f48caca61b5631e5f
SHA512 4d4672131c360c7824eb7fa0fe069a488fe67a1c2a82959a4a060c1ca4cd6eeb78ae7c0090f142918beaf4487cfeebf8e4387701d3af1af96b7019b3f6155c71

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 c03046ef1c9a502393c7258c2a4ed413
SHA1 062fa0f8612077acda34ab4267106869ef9b824b
SHA256 1682fb6089ab7980137007e40fde0f1cf973487376f78ca233c317d9eb8a050b
SHA512 ea5a0550ba77c1bfc6207ddbb3461edbe6e3af899b7c07a199c96064e56d42dc1b6293f4149ff6a440b939afda4f43117a1e978a0340875984769e85050b456f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 12c2e9c3a300c80fbb1c73bba860c9ea
SHA1 a58a7289edef90fb1c71e4767057b45b6958677c
SHA256 cdd5e703504df443f92dca084fe2700282bb46265f67e3638819d0fe1b6b3a23
SHA512 e71b2222f6a0521f42410bb650191450a70da3d1d883c6cea787cb633b6b664ff539972c3293b4f59412dca04d617ab72e07bf79ff442bc41ecc6e981ee476bb

C:\Users\Admin\AppData\Local\Temp\TCD8465.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 c37c38965700041b3e6ab24995476fcf
SHA1 4db124228410e3872b52308f04fdddaea1091244
SHA256 8816e1679dd8b73c61d4fbb791e2610aaf3d95107b0e12412d80f8d2e96310cb
SHA512 fad35dee74503f3ae4025456d51971e4d878e593342c2d490dd60bec26492c4f3607c6f8aab8a19fbda1b332e6d33b09109239c3647ae6da816f63dcdcfc92c6

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 6af3aea696edd81ff71fbaba42c4e1fc
SHA1 8f48559846a0071e60fd1dc44348ccf93a814c49
SHA256 86b1d23e589b5a80b55e2b42b98df339c8ea1e7008e629096c0e17e886b8c952
SHA512 6b00fe7d3bc3e74a5509d288e8ed90349ba4e0691aeeb1e857444c269802b29a10e813a53849f57f83046913a3a7e01e3aee197e5108474c96c9f964b9d99768

memory/2284-596-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-597-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-598-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp

memory/2284-595-0x00007FFE89D10000-0x00007FFE89D20000-memory.dmp