Malware Analysis Report

2024-09-11 13:30

Sample ID 240613-3mc6xszamp
Target a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118
SHA256 7ffa13e05eeaf1773743b875187ba4633809f68653953e321eaee0c6d14728d5
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7ffa13e05eeaf1773743b875187ba4633809f68653953e321eaee0c6d14728d5

Threat Level: Known bad

The file a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Windows security bypass

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Windows security modification

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

AutoIT Executable

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:37

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:37

Reported

2024-06-13 23:40

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xpknjtor = "llpjstmfgz.exe" C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vgtgzjgw = "zpcynwjmbqyeocn.exe" C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jezvxnqvpeqge.exe" C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\a: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\llpjstmfgz.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\qgveeavc.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\jezvxnqvpeqge.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Windows\SysWOW64\llpjstmfgz.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\qgveeavc.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File created C:\Windows\SysWOW64\llpjstmfgz.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\jezvxnqvpeqge.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\llpjstmfgz.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\qgveeavc.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\qgveeavc.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\qgveeavc.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\qgveeavc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334F2C0F9D5083556D3F77D470542CD87DF265AA" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFF824F2A82689030D7297E94BC92E632594266466342D791" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC60F14E6DAC7B9CE7C97EDE037CE" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9CBF911F290837E3A4686EA39E3B08D038A4261033CE1B8429C08A4" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\llpjstmfgz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB12D4493399853CBBAD33393D7C5" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B5FE6F21ADD27AD1D18A0F9013" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\llpjstmfgz.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\llpjstmfgz.exe N/A
N/A N/A C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe N/A
N/A N/A C:\Windows\SysWOW64\jezvxnqvpeqge.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A
N/A N/A C:\Windows\SysWOW64\qgveeavc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1964 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\llpjstmfgz.exe
PID 1964 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\llpjstmfgz.exe
PID 1964 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\llpjstmfgz.exe
PID 1964 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe
PID 1964 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe
PID 1964 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe
PID 1964 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 1964 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 1964 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 1964 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\jezvxnqvpeqge.exe
PID 1964 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\jezvxnqvpeqge.exe
PID 1964 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\jezvxnqvpeqge.exe
PID 2532 wrote to memory of 3768 N/A C:\Windows\SysWOW64\llpjstmfgz.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 2532 wrote to memory of 3768 N/A C:\Windows\SysWOW64\llpjstmfgz.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 2532 wrote to memory of 3768 N/A C:\Windows\SysWOW64\llpjstmfgz.exe C:\Windows\SysWOW64\qgveeavc.exe
PID 1964 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1964 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe"

C:\Windows\SysWOW64\llpjstmfgz.exe

llpjstmfgz.exe

C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe

zpcynwjmbqyeocn.exe

C:\Windows\SysWOW64\qgveeavc.exe

qgveeavc.exe

C:\Windows\SysWOW64\jezvxnqvpeqge.exe

jezvxnqvpeqge.exe

C:\Windows\SysWOW64\qgveeavc.exe

C:\Windows\system32\qgveeavc.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

memory/1964-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\zpcynwjmbqyeocn.exe

MD5 5b61bdec205298724545ffbc08a78a55
SHA1 e26e5d11a5d29e847ddc3b05f0369c1f500ab4ce
SHA256 1175cdfc1201b90589c1b4b59e4afb8b69a279641380c19c0998ba98af5205aa
SHA512 a8c5a0b963bb93ba7d737dd089d45ac0c20f9e89c5faa11969fef01cb1a3b992ddcdabbe21731937f1804d0d4a91473f889a2b5ece7d14a57db3013d658a96bd

C:\Windows\SysWOW64\llpjstmfgz.exe

MD5 1bf48aa8702164b79f3d689d412640c1
SHA1 e3d23b51715044000f37651e937e82a7b4ac7999
SHA256 452d0395d742e1c39899c4e72b6b7ee80875e40116436043aacd878e86a8df15
SHA512 96cc2da372060e3e589e95bd2b0c41ed757a0977c82455339cbec8ea64567541b2d31422968c166a35710aa4064ab6c37561ea3d89ff37ada8e6b058850e82e7

C:\Windows\SysWOW64\qgveeavc.exe

MD5 71d6694e5f31d66e17009e09d8bc42d8
SHA1 5cd912c6beca1d728f4bb23729575a7ae4d17014
SHA256 d6f6a7cd945f6940777b66d3541ce7dccbdde145b83e8800c9ba5d303032d2e7
SHA512 9751e754c5210d19d3dc5d905762d0e7d8b2bdc5ac414bd3ace5b81e9d774cd5568ff2aded2f36eae12af73e600ffc00fcb5e780e27284569ba40dfec110ca84

C:\Windows\SysWOW64\jezvxnqvpeqge.exe

MD5 fbb58d53550b3ff36d2fa94570b216d2
SHA1 2882bf298f4ad9eada45542dec46660aa3a919dc
SHA256 336e5c6a979f1fa5be0e519456e0405ad875f6bfd1a4f5bbedb3d06d4e5b5dd2
SHA512 78f1f625f07a08035a85f7e2c6832494ccbea2a2cf88149319527a0a09927772611e6f01cd51b47f34c532c54374cdbc18e4777698f96b18a21ed3403175753a

memory/4912-37-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-39-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-38-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-40-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-41-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-42-0x00007FF964470000-0x00007FF964480000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 cef055fcae2e7c722084dc34da958485
SHA1 3fdf3494eb2da51e48b6e72ca34b4b0bc00f9b92
SHA256 fae1a11d59ad7a68fc5c9ceb0570be48228b11fa5293f4aeeb95247119b2629a
SHA512 23a105491ea36a8ef820676ba397a1db94f00fcbe85666615bcd1296a9b0e6d3ca575e09a6d4b05e8e96dffeda395db082b59b15914fe9f30dea835671319fea

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 a5f879d93ed8620a39d688d2168b1190
SHA1 7eb86997d1477528dfa592a5c771d911fa7a6146
SHA256 75f94654168d3636128e50c62a167f0efcb48bb208c36f06f677b18ace080483
SHA512 b21ac6cc130f34ff9eb397a60067750afef5f42fc138213dfaa18c058ff91c8acff64b75e4924733353fb47fc4235535a7ef74008e1ceb35232a3da62acafb14

memory/4912-53-0x00007FF964470000-0x00007FF964480000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 f4ed5c8149b73fb9c22aa8786475e375
SHA1 49a4b2f57a21017ff6f0eaa04669a34906ff4318
SHA256 ec191ecc2e71f3f7e27328d47c27541c499a0e9722db1931a88aac9b39cbcb26
SHA512 69969bf646730ff9364c45d1bad782a2eaa07e23c8349d33e1f026710a2fa458fa74c466322676886b4bc0cc68692313985a5f6e4b610c5f3dea39ff1433de8e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 5cf715a0f90ec57af93085ad61d45aa1
SHA1 d14f5d9a28fb3d9f213e10718610073083207ca0
SHA256 dda6c427383e2097ce8c722b0fe08d203571d4c6e7aee3ca6aa06e106a3f8927
SHA512 394257ff3e365b8249cdfc6adc11daba7b6bbf368cbb3690314284140b594a54bf5a93e40dfef8df588a91ac0d314abc4c62a3a879ce0d3d39ee56d96b502bf1

C:\Users\Admin\AppData\Roaming\DenyReceive.doc.exe

MD5 958966a9d1875286e9217995c8558f14
SHA1 e9a967eba82dcf578ee106e1c479bcfa4601cbdb
SHA256 a44fd933ed3d39672969d931495152678792dff1b7cda7b617201f872f4ce3a1
SHA512 dc6afb8ea73b2c4dd9d5adf13dd9a7451e7c4998d6bfc439a03102b8cf090bb3ece81c073c2b6bab28db039def9c47a0389cd4f25a14ff37e1ccd2bccf1d1cb4

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 6ced8f8421f0e759f7c978913e1bb6df
SHA1 13a3f998079bedbb9692d55a8bdb9478462efe3e
SHA256 765da6e22c0296f52aa2508f715b6db5b438006f558cd495d2a1293b89040253
SHA512 3ffb7e2282e5916b031a8c06a11a936cc72badc9c6ad82c8484a59a678b90cb529931503fabcd1bf51dc8fe82ef543a99e7f35ac34ee831688f3008138c1ae5d

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 585744343b73263d0f072991247b2d3c
SHA1 fc7469c7ff2f81e542f96201655ceaae8b1ae877
SHA256 c18a00c6136375580076106091f3a843d74ce85a84a617e27fb13eb7b79d3b90
SHA512 1052c55bb36e9fa869a160a16160e970cc9082fff24c7a7f683e42329283215b8c70cfceb55718509c932dcea17b786ce2b7582708497903e99e789b07490465

memory/4912-124-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-127-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-126-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

memory/4912-125-0x00007FF9667B0000-0x00007FF9667C0000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:37

Reported

2024-06-13 23:40

Platform

win7-20240508-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\pzknttupcc.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\pzknttupcc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ecvifhjt = "pzknttupcc.exe" C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rwmzwkdv = "ngtbhjlyutdupsu.exe" C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qzzwsmlpspkzg.exe" C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\q: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\pzknttupcc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\pzknttupcc.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\pzknttupcc.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\pzknttupcc.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bdjjkasx.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\pzknttupcc.exe N/A
File created C:\Windows\SysWOW64\pzknttupcc.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\bdjjkasx.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\qzzwsmlpspkzg.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\qzzwsmlpspkzg.exe C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\bdjjkasx.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\bdjjkasx.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\bdjjkasx.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D0D9C2283516D4177D477232DDE7DF664DA" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFACAFE10F1E083783B4B86973E98B38A03F04313023CE2CE459C09D6" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\pzknttupcc.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\pzknttupcc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FC8D4F2A826F9042D72A7DE0BC94E631584767356234D7EA" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F46BB6FF1D21D1D209D0A68A089011" C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\pzknttupcc.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\qzzwsmlpspkzg.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A
N/A N/A C:\Windows\SysWOW64\bdjjkasx.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2104 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\pzknttupcc.exe
PID 2104 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\pzknttupcc.exe
PID 2104 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\pzknttupcc.exe
PID 2104 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\pzknttupcc.exe
PID 2104 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe
PID 2104 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe
PID 2104 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe
PID 2104 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe
PID 2104 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 2104 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 2104 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 2104 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 2104 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qzzwsmlpspkzg.exe
PID 2104 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qzzwsmlpspkzg.exe
PID 2104 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qzzwsmlpspkzg.exe
PID 2104 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Windows\SysWOW64\qzzwsmlpspkzg.exe
PID 3044 wrote to memory of 2772 N/A C:\Windows\SysWOW64\pzknttupcc.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 3044 wrote to memory of 2772 N/A C:\Windows\SysWOW64\pzknttupcc.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 3044 wrote to memory of 2772 N/A C:\Windows\SysWOW64\pzknttupcc.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 3044 wrote to memory of 2772 N/A C:\Windows\SysWOW64\pzknttupcc.exe C:\Windows\SysWOW64\bdjjkasx.exe
PID 2104 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2104 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2104 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2104 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2580 wrote to memory of 484 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2580 wrote to memory of 484 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2580 wrote to memory of 484 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2580 wrote to memory of 484 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a722f0777d032da6d8cb194a5fa8c241_JaffaCakes118.exe"

C:\Windows\SysWOW64\pzknttupcc.exe

pzknttupcc.exe

C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe

ngtbhjlyutdupsu.exe

C:\Windows\SysWOW64\bdjjkasx.exe

bdjjkasx.exe

C:\Windows\SysWOW64\qzzwsmlpspkzg.exe

qzzwsmlpspkzg.exe

C:\Windows\SysWOW64\bdjjkasx.exe

C:\Windows\system32\bdjjkasx.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2104-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\ngtbhjlyutdupsu.exe

MD5 8587b0ec35998fe0e8777efa97452740
SHA1 d4b0c8514be947afe82bcd2136b638e172678e0b
SHA256 6fe71d31aef59127a5d12c41b38be64e775043ca9fc0d6fe624fd3f0af1137de
SHA512 316481c6873f8d8d46c3c2eb72a4789b14e85d993099aa30944f4bb52e38eb1e46cb31619ee5ee8d3c02adda296de8cad431ed6b1d663dd802cd270e2e4809eb

\Windows\SysWOW64\pzknttupcc.exe

MD5 3b42d3787db2daf429a3b65bf086ce94
SHA1 44fa2f94f8ef9e2f71526a0f3e04a55f6a7c991e
SHA256 bec9313619e10a80e21b6b1d9ee04340325ad412a874eb288bb9a56babbf36fd
SHA512 32cb0f64074125b177e6a7e42cb3d548424b886603ff7db7c9e9aab076b3c06a4e4cbb2612beccbcdedc4dd695f3e18dff1b7a4de8ad4e7aef6a821bf6f0acd1

\Windows\SysWOW64\bdjjkasx.exe

MD5 5b196749b960bf74b6038ab087c37098
SHA1 d5bf949a54e52ca8ffa7890d31d990c312cc826c
SHA256 02f2260fbcee0e873e430c2b508be3972f80291beff28c702de83f25dbcb531e
SHA512 e78eeffe1116db9d270d550a6acc85f96d524c5a9d3022ddd9a56e6638eab310ee8460fdb31f30dd161852bdf5a9530a65a64b61760b37b3ce8205c09f721331

\Windows\SysWOW64\qzzwsmlpspkzg.exe

MD5 61ffbba6429612bca6a70f78a2394f4d
SHA1 1062b433c09b0e7e6b3a3d43e81323cbb444863f
SHA256 56984bfaa4d37e78e2dde13ac6a29cfe4565f5479ed43e82a56a9cdef78d9146
SHA512 d4892c6bcd8602a094971eb230366290b709594167e2c8e54cefa039caad784542a608e96020399f7af06d063d02492671e6370e75b98ccb75138ad84f3f062f

memory/2580-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

MD5 024a671a01dabe9c24f8ce729d8eddd7
SHA1 285354595309d5b1c321743df8e2078cdb4bfbf5
SHA256 3d5d4c380e4f289918709cf16101c7f0f10be81a504eeeb542bc3fc3aa8b2ab8
SHA512 3eadddd8fdc678e434196ecc7866660bfa4b073ccdb986706e6c1696297930dee00f1616deb08e93734026bad53c5fadb2f34c4f4755607a5f7e797dd7311ba7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 96e3475392b76e1e5271d7728d5f8924
SHA1 ea198dc796ca9431dd5f3cd5e262d225a92a997a
SHA256 5e9128a0d8259ea2b4367c731989d08b5c2003cef2492ecd3553350a13de8c75
SHA512 2c7bcec90fa35af4c55f73025870e0968ec4e038c802fc8d40113c8bc6b92c69e5f509aeb8dc3b86bfe876aa09042b45fcdb831b7f6d7323df4f6545a49dbfe4

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 8104390275feb34118b3dc861f355c47
SHA1 fdade20d59c1e401929e921bde4f149c34d5aa2b
SHA256 35eb08a590af3ffe4b94154d3c5ea1c9cccc3c2dfe2e73f4f61977878b1a388b
SHA512 859ccd5c6b59ae5b96b09fc7fa81c9110f5bbd3b0af25e8b6e95d1fcfa36a88decc8bc2c5cb1b32f4747f1ce8b28a4cd0b834fff54892b2bd77df2694d15ef09

memory/2580-105-0x000000005FFF0000-0x0000000060000000-memory.dmp