Malware Analysis Report

2024-09-11 13:31

Sample ID 240613-3pgxwszblr
Target a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118
SHA256 a763f6987b60008555cbec1f0e9221b73a5815a9726dbed36723e82e6462294a
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a763f6987b60008555cbec1f0e9221b73a5815a9726dbed36723e82e6462294a

Threat Level: Known bad

The file a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Windows security modification

Reads user/profile data of web browsers

Modifies WinLogon

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Winlogon Helper DLL
T1547.004
Defense Evasion
TA0005
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Modify Registry
T1112
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:41

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:41

Reported

2024-06-13 23:43

Platform

win7-20240419-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\thngmypw = "ezpfmtbubq.exe" C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\epebrvgm = "ohmzbmbldqnfgxl.exe" C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zwedfsqrqpmgq.exe" C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\g: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\cvwafvfv.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\cvwafvfv.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\zwedfsqrqpmgq.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cvwafvfv.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\zwedfsqrqpmgq.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ezpfmtbubq.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\cvwafvfv.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\cvwafvfv.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cvwafvfv.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33462D0D9D5083596A3177D470242DDB7DF565D8" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ezpfmtbubq.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\zwedfsqrqpmgq.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A
N/A N/A C:\Windows\SysWOW64\cvwafvfv.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1824 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ezpfmtbubq.exe
PID 1824 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ezpfmtbubq.exe
PID 1824 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ezpfmtbubq.exe
PID 1824 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ezpfmtbubq.exe
PID 1824 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe
PID 1824 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe
PID 1824 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe
PID 1824 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe
PID 1824 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 1824 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 1824 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 1824 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 1824 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\zwedfsqrqpmgq.exe
PID 1824 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\zwedfsqrqpmgq.exe
PID 1824 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\zwedfsqrqpmgq.exe
PID 1824 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\zwedfsqrqpmgq.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 2608 wrote to memory of 2640 N/A C:\Windows\SysWOW64\ezpfmtbubq.exe C:\Windows\SysWOW64\cvwafvfv.exe
PID 1824 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1824 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1824 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1824 wrote to memory of 2464 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2464 wrote to memory of 1020 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2464 wrote to memory of 1020 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2464 wrote to memory of 1020 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2464 wrote to memory of 1020 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe"

C:\Windows\SysWOW64\ezpfmtbubq.exe

ezpfmtbubq.exe

C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe

ohmzbmbldqnfgxl.exe

C:\Windows\SysWOW64\cvwafvfv.exe

cvwafvfv.exe

C:\Windows\SysWOW64\zwedfsqrqpmgq.exe

zwedfsqrqpmgq.exe

C:\Windows\SysWOW64\cvwafvfv.exe

C:\Windows\system32\cvwafvfv.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/1824-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\ohmzbmbldqnfgxl.exe

MD5 5a57dcc37feead2adb4fd150a661a312
SHA1 686f304cef31b231833e283c0649b88c893b068b
SHA256 f2b421fc17ae82c8f370c8c0c62c50442335599dd42fc34e63eb0e408c025cf2
SHA512 c0cd616f5e7a51e58a5f6fe07e9579629518012e13bd482de3c713af7c213379bd713db325531a5301051ab07fa22c7984640228007685699a33b175549c60c9

\Windows\SysWOW64\ezpfmtbubq.exe

MD5 df711bbb58f08356e04b7e41906e2ca4
SHA1 aeb1f6b88ddfbbad1d8c4622042db439acae3a9c
SHA256 c7958186b7e13761bb08d1db6bb524d5ee78c28a91fa8c694d8bb3d5fbb07a42
SHA512 ab8a0faa2dcce516b2a639a62cb36c6f5b2ac3e86bc8201e0edac6fd820a602d7a38e21f567d1a1b296126fa6fa7d9a319f227b53f993944b1db53ed0c1fb2ae

C:\Windows\SysWOW64\cvwafvfv.exe

MD5 e32aff7e6707d37e85d55e3bb2788bdd
SHA1 92dd1e9479008658448fbad32ecb5efc987b03ca
SHA256 dfe5f868d3afd2367fa49ef22462a0bebeadb343d42a48081242755a850ccd7c
SHA512 a7220b1c82a8ee1e097e33bfe0f58727090c56212838d77ec6e4a9174c24e91cd5b5328a1436e364db93a5be843c049a140dfe5376051e39ddf0a630ab3329bf

\Windows\SysWOW64\zwedfsqrqpmgq.exe

MD5 3804300d9c0fd6f16653a71fbb377d75
SHA1 8407fc7f60c2c60921dcfc7f58d643ef437a99aa
SHA256 07bfafa14ffa24ba7ce2cd3374697b7e78a5a9e2780ff81e8b7d14f16ba55017
SHA512 4f731e9cf62d208c69920427d5894675ad46289c36291bf6f4b9591ce2bc71f17db4b8d2641d6c6443783b9cda40586c8d1d87513379ff9ea7f68adfe9f4395e

memory/2464-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 475485d35cb45ff6ef6b71d56d9d5a8a
SHA1 8815f850ee8b5025c555d5dba8de57bc34fd5fa6
SHA256 9526221d83759f4229d68127fcc16439f58593cf2963b6d5abf3b42e7f0459d2
SHA512 d1e3c900dc48e0d2288f60a7e5262ea5ae0e4061ba383f0565dba215a347ed9915aa48aa8c57315d89660c15cca4bc512e184f32a418ab509421e6836366ba73

memory/2464-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 b1cee4c7f9af1687f54d6d83594f5b71
SHA1 472c1279917f46f706faa82e75d88442c5b712b8
SHA256 5c02c470c3a6888763dd18be56081ba4d4c89b9d2ff70f8e8b006e1ed62a6366
SHA512 5eab2430686371f35052ab53a72e82d36e31e4177ff2291e78af181b3ebea9e6df4671a057c953f46ec91a2e0c667b37eb7e581a22881f90474cac5f88951c58

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:41

Reported

2024-06-13 23:43

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xhjbszcgjxtkv.exe" C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yafdwuyf = "hkqnlciwca.exe" C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\efjcoyuh = "xeudqnxyauofoku.exe" C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\j: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\cbheqaal.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\cbheqaal.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\xhjbszcgjxtkv.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Windows\SysWOW64\cbheqaal.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\hkqnlciwca.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created C:\Windows\SysWOW64\hkqnlciwca.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\xhjbszcgjxtkv.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Windows\SysWOW64\hkqnlciwca.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\xeudqnxyauofoku.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\xeudqnxyauofoku.exe C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\cbheqaal.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\cbheqaal.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFAB1FE13F1E2840E3B3081EC3E98B08E03F14367033FE1B842EB09D6" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1845C60C1591DAC3B8CB7F92ECE234BA" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C0A9D5783516A3076D3702F2DD97DF664D8" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B12847E6399852CFBAD332EDD7CA" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FF8F482A85139042D62D7D96BD95E141583066436335D6E9" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0816BB4FE1D21DCD10ED1D28B099117" C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\hkqnlciwca.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\hkqnlciwca.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\xeudqnxyauofoku.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\xhjbszcgjxtkv.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A
N/A N/A C:\Windows\SysWOW64\cbheqaal.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3056 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\hkqnlciwca.exe
PID 3056 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\hkqnlciwca.exe
PID 3056 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\hkqnlciwca.exe
PID 3056 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xeudqnxyauofoku.exe
PID 3056 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xeudqnxyauofoku.exe
PID 3056 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xeudqnxyauofoku.exe
PID 3056 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 3056 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 3056 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 3056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xhjbszcgjxtkv.exe
PID 3056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xhjbszcgjxtkv.exe
PID 3056 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Windows\SysWOW64\xhjbszcgjxtkv.exe
PID 2316 wrote to memory of 4704 N/A C:\Windows\SysWOW64\hkqnlciwca.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 2316 wrote to memory of 4704 N/A C:\Windows\SysWOW64\hkqnlciwca.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 2316 wrote to memory of 4704 N/A C:\Windows\SysWOW64\hkqnlciwca.exe C:\Windows\SysWOW64\cbheqaal.exe
PID 3056 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 3056 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a72596aef6eeb01fbc72ebcdd79cdfc0_JaffaCakes118.exe"

C:\Windows\SysWOW64\hkqnlciwca.exe

hkqnlciwca.exe

C:\Windows\SysWOW64\xeudqnxyauofoku.exe

xeudqnxyauofoku.exe

C:\Windows\SysWOW64\cbheqaal.exe

cbheqaal.exe

C:\Windows\SysWOW64\xhjbszcgjxtkv.exe

xhjbszcgjxtkv.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\cbheqaal.exe

C:\Windows\system32\cbheqaal.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3320,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp

Files

memory/3056-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\xeudqnxyauofoku.exe

MD5 474d7046d112a99afba99be74f44e2b6
SHA1 7c2354d0eb6583d4d7520ffa06faaf07117bb8ac
SHA256 485cde23e349517dbaeeb0201f072a212ec7748245da6ea1267b1319963883bf
SHA512 b47db250fddddb696865a19f589bbe893a80f546bfa39963f202d5ca045bd9d4f786f98d172febb7aa5975791c5733e65bdcf1e4ccafc25202b8fd08179e1c4f

C:\Windows\SysWOW64\hkqnlciwca.exe

MD5 d5710929945eaea7c7294f6d6eede9f6
SHA1 5818772748f7a5af4fb05f240214265903710707
SHA256 c7bc7ac423a8a2e766f92f9aafa574e8ed9a46cd9faee7529a183438e482142a
SHA512 84c9f2fbf7054d16ec516bba640fa830d0cda6b35dfb70efe8c062e7af0895316562ab1f4d6350516145ff8d5ef24c0f0b2c6782389cb9d245a26d05261ad694

C:\Windows\SysWOW64\cbheqaal.exe

MD5 4264ac3342c032a0334d08a2731dde0a
SHA1 a53cf24b3270d69f0994dacdedeb56eebcbc8507
SHA256 44ec1bb2bbc4773ef8f4b5455f71fff294dd6d4ee82118b359cb0746a78a61d1
SHA512 bbe1ba4e9e096da44a64fac8906533d4a3fafdfb1443e2fd0424deae951e91af90b364da81dc7e9012245f495fa7e5a57c8f4f7170a84f4ca15b6b698bb893ed

C:\Windows\SysWOW64\xhjbszcgjxtkv.exe

MD5 4c9b387760f41bd5a0a2e4a67643d63f
SHA1 907cefa36c759fddc226d25f6a7281e2c21a317d
SHA256 9ca31c8f23c5bcabfc04533b4fee113d667bef3e68cdd2c421ac93be113d6627
SHA512 55b64561d923bf5e30b7eba7bd86e9cb0d0658fdd7f1e28bee94046c674381fc509f2ece5b23bb9239624098edc3ea7aed3abcf11b41088f733872544fe14bef

memory/740-37-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-38-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-39-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-40-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-41-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-42-0x00007FF7C2170000-0x00007FF7C2180000-memory.dmp

memory/740-43-0x00007FF7C2170000-0x00007FF7C2180000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 a952d4aa47ee01e8b72e91779ea2ea36
SHA1 22d9aa39a807062932b17e3a29d1d980bb22056a
SHA256 0178a9e23606f337f47239fb79c0403adedec01788ad574fac15082968c8c4fd
SHA512 979d5776e0d319e0995bb67f93e1667e850854e5f07e65c784fa950fc29f4fe66eeef1a48e4ce6b2b22513c96d4ecb240ea68b544bb847e23cbc5ee0d51b6186

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 357671963551c33a946e1a446d4e2ee9
SHA1 374469d2fab52e0208249f84ad40cf85b1f7c909
SHA256 6004c8e28785711f8a5afbcd8a0895ea56894f753d397ffb89950401bab80b7e
SHA512 90389b11cf1d836da3df0e059aa11ffb98c0540f4b0f907dd884fdfbdaed700b33b715af4db39777a8683f051371c369ccdb913fddc21d7c865fac05afbf5396

\??\c:\Users\Admin\Documents\DisconnectTest.doc.exe

MD5 d7b4d27b2ba1dc8d6e3e55b15bdd012e
SHA1 ac04627ac8981b3df431184c02abe4444148326b
SHA256 1f21c603ef156ba4448d1659f6b9090cbecf636d774e5a60e57e8083ba15f910
SHA512 f7e834814c09cab3b31812d37c2e35b48c933d209854ad271a6684a54fc9e234515b17f763b7d995d8dd494dcacf8f4b4357b4983812952e47c40df7413f713c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 bff8a42045b1f378d6067d970885d7c9
SHA1 0c908dc9df7e0c4758f048b2e9a156d17c9b72c8
SHA256 f4d081464e9957cc78d63935c865f520a6465cb40db133ec87a2fff04dc1df6c
SHA512 8b0119e64ec7538b248563755ae3f311796b54e96e4382adfae3146343b9d199d3830af249c25c8cf3b4116cfcab9e4a657e6e902273ac3c700e173568470fd8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 96a59ec94231b29b70cd620c235d34ec
SHA1 db31f9a6fac767063df13a7c4cf110f75e0783c0
SHA256 763ce4503d555ee49850117a125b6c476b0221303e300f9fccbdb4ba404c456e
SHA512 c6525657fcae1abd86601b20d2ec3058a814744ad2ede118399443553418344de2d2d41a9911813d11bdf871da7a0eff702a26de1f447a7a6cee3b70e434e8d5

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 a67febb0eed0352e511912c6ee3401ee
SHA1 2d8e4ba34d3f5ea712b550dcbdbecd95beadaca7
SHA256 fd0d8c9541813d19a971ced246984eb9160e40a63eaf1acbebbe4853dfd70a51
SHA512 ebd072df75f43ca554064743106e7ab99ed5f454076563a47492722e1559a1b170732a8b9aac6a09ccc46ae077edb53ba9ada0dd1dd5d297fc34d8096a62dd96

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 0f8c34487fe78821887e2ca6a3502a1e
SHA1 25bcdbf97c5ad6fb6644dd7410cdd0423ffbfe9d
SHA256 7648a0c5e4410490bd4c00c425315d666a8f8c3b28fa23646827b254b73912f1
SHA512 a7b26bc8c52e2f58a7c4b65980d1cae29d707ab7a820eb63f178adf02050588f5b0fdd78d1a6c7f766854cef3522eb2426e966e76e83bd35a846f5a19d395331

memory/740-120-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-119-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-121-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp

memory/740-122-0x00007FF7C4990000-0x00007FF7C49A0000-memory.dmp