Malware Analysis Report

2024-11-30 04:19

Sample ID 240613-axfetaxcnh
Target a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118
SHA256 b33d1e9e58201f4d6731c6a5890e5d082c263aa18910369917a229fe0643ae60
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b33d1e9e58201f4d6731c6a5890e5d082c263aa18910369917a229fe0643ae60

Threat Level: Known bad

The file a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Modifies visiblity of hidden/system files in Explorer

Windows security bypass

Disables RegEdit via registry modification

Modifies Installed Components in the registry

Loads dropped DLL

Checks computer location settings

Windows security modification

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Modifies WinLogon

AutoIT Executable

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:35

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:35

Reported

2024-06-13 00:37

Platform

win7-20240611-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jjtysaam = "ydzfrcvutq.exe" C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\pmhpyazb = "sogmsrgkxsrgoqu.exe" C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wncqznszutrmn.exe" C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\z: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\przsmjjc.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wncqznszutrmn.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\przsmjjc.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\przsmjjc.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wncqznszutrmn.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\ydzfrcvutq.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\przsmjjc.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\przsmjjc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDFABBF96AF19484083A43869C39E1B3FE038C4211033EE1B8459A09D6" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC67C1593DBC2B9CD7CE5EC9434CB" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32352C7C9D2383596D3E76D377202DDB7CF365D8" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\ydzfrcvutq.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\wncqznszutrmn.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\SysWOW64\przsmjjc.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\ydzfrcvutq.exe
PID 2208 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\ydzfrcvutq.exe
PID 2208 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\ydzfrcvutq.exe
PID 2208 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\ydzfrcvutq.exe
PID 2208 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe
PID 2208 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe
PID 2208 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe
PID 2208 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe
PID 2208 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 2208 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 2208 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 2208 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 2208 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\wncqznszutrmn.exe
PID 2208 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\wncqznszutrmn.exe
PID 2208 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\wncqznszutrmn.exe
PID 2208 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\wncqznszutrmn.exe
PID 1960 wrote to memory of 2500 N/A C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 1960 wrote to memory of 2500 N/A C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 1960 wrote to memory of 2500 N/A C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 1960 wrote to memory of 2500 N/A C:\Windows\SysWOW64\ydzfrcvutq.exe C:\Windows\SysWOW64\przsmjjc.exe
PID 2208 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2208 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2208 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2208 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2532 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2532 wrote to memory of 2008 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe"

C:\Windows\SysWOW64\ydzfrcvutq.exe

ydzfrcvutq.exe

C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe

sogmsrgkxsrgoqu.exe

C:\Windows\SysWOW64\przsmjjc.exe

przsmjjc.exe

C:\Windows\SysWOW64\wncqznszutrmn.exe

wncqznszutrmn.exe

C:\Windows\SysWOW64\przsmjjc.exe

C:\Windows\system32\przsmjjc.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

memory/2208-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\sogmsrgkxsrgoqu.exe

MD5 83e8148cb3f404c93729cbb2e4979e1a
SHA1 d82e1580659c6ce445faafeddf3230b90b61096e
SHA256 c75cba27e9d447dbe0600c14ecc69f00e8f284a8be432b7166eb30b282cdc4f9
SHA512 003a38562ee2f01797a4ac8ddf464152339a92d9f9381a8a13c9bbd57a84836ce32c60c1167c5e9ea60ad614acd4c6bdf998e954bea98fd13a2b816e3bde961a

\Windows\SysWOW64\ydzfrcvutq.exe

MD5 d10ffb4b4e455e43fee0acc27ea1eca2
SHA1 517e933b9f0340b0fcf5a83f87ca046966a98170
SHA256 6ced82e3ef72b794be3ed4fcf2fea9b09dded5cba39fb3fdf482f0bf0223a52a
SHA512 edfaf15cf1bfb6e3ae5c7a1e658df404327401bc8b5424cec5b594b093d02851679bdb2f326418daeca30cadcbbc560c4344a615032c31f7dac005a3ae949fc2

\Windows\SysWOW64\przsmjjc.exe

MD5 1b599b60d843678c340c7eb30277103d
SHA1 b785eb48f72a2e42d6ce347d71f94a5120485253
SHA256 96c5e7c2b0edb50dbab72607764a06de4079ea50e7abeed3810e92dc1d1db3e9
SHA512 d77f0e24f3471eea24a4b4df9ec6c91773a5ec6efb356e1d7e2c3578bb54c55b45d9c70659dd4252a7a075e4f0c28f6304d65059d3a7c763361993fd8863b249

\Windows\SysWOW64\wncqznszutrmn.exe

MD5 486eb6b59a16fd47b5b794e6a93b4cc7
SHA1 cc741e27988977b6ab19956b8ec16813edf33443
SHA256 1467e250733cddfcd93b307b107f5fddb3e23f215073a3d6502b7cf5fad0f7c4
SHA512 3990b7f328ace2039bbcee53702c3719562b3ed02c04cd1789fffea2fc24dd91d95de1eb04968b2afa18e21522e70ce8692823f0f3b127fbd08156acb70d2461

memory/2532-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

memory/1332-85-0x0000000002650000-0x0000000002660000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:35

Reported

2024-06-13 00:37

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iiapdlcs = "dblxtkzqjq.exe" C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zxghjjcd = "nrgkcehcrnnrvez.exe" C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hozzcgisstxja.exe" C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\j: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\dblxtkzqjq.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bzczgsnf.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hozzcgisstxja.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hozzcgisstxja.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created C:\Windows\SysWOW64\dblxtkzqjq.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\bzczgsnf.exe C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bzczgsnf.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBF9CDF96AF19283083B4486EC3992B38D02FA4366023BE2C8429E09A0" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B020479438E853C9B9D1329BD7B9" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BC3FE1C22D8D20FD0A28A7A9010" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FF884F2A821B9142D7207D9CBCEEE6315843664F6334D7EC" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "194AC77915E5DAB3B8CE7C97EDE434CD" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472C7A9C2582576D4176A277552DDF7D8465D8" C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\dblxtkzqjq.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\dblxtkzqjq.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\hozzcgisstxja.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A
N/A N/A C:\Windows\SysWOW64\bzczgsnf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4040 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\dblxtkzqjq.exe
PID 4040 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\dblxtkzqjq.exe
PID 4040 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\dblxtkzqjq.exe
PID 4040 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe
PID 4040 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe
PID 4040 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe
PID 4040 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\bzczgsnf.exe
PID 4040 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\bzczgsnf.exe
PID 4040 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\bzczgsnf.exe
PID 4040 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\hozzcgisstxja.exe
PID 4040 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\hozzcgisstxja.exe
PID 4040 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Windows\SysWOW64\hozzcgisstxja.exe
PID 4040 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4040 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 2816 wrote to memory of 848 N/A C:\Windows\SysWOW64\dblxtkzqjq.exe C:\Windows\SysWOW64\bzczgsnf.exe
PID 2816 wrote to memory of 848 N/A C:\Windows\SysWOW64\dblxtkzqjq.exe C:\Windows\SysWOW64\bzczgsnf.exe
PID 2816 wrote to memory of 848 N/A C:\Windows\SysWOW64\dblxtkzqjq.exe C:\Windows\SysWOW64\bzczgsnf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a32c011683e969ae4ea2aef62de0d06f_JaffaCakes118.exe"

C:\Windows\SysWOW64\dblxtkzqjq.exe

dblxtkzqjq.exe

C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe

nrgkcehcrnnrvez.exe

C:\Windows\SysWOW64\bzczgsnf.exe

bzczgsnf.exe

C:\Windows\SysWOW64\hozzcgisstxja.exe

hozzcgisstxja.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\bzczgsnf.exe

C:\Windows\system32\bzczgsnf.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
NL 23.62.61.162:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 162.61.62.23.in-addr.arpa udp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
SE 23.201.43.112:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 112.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/4040-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\nrgkcehcrnnrvez.exe

MD5 8aed82ef783f3d9bf633b26c8f86708f
SHA1 c3dd887afa6d2e1241c17cb4c7aa31018eaf6670
SHA256 1d09c71d5df015f3a715ba72c6311662d62fe8ac3a332ee755bc542eb57f5b1c
SHA512 b19f554de309aced9f08126cf923dee66321e05b22aa2d18697c905da4052fcdbb4bcb777a1541b0e00a449d8379c054f05fff76c95a46ec7cd0f112ebad920e

C:\Windows\SysWOW64\dblxtkzqjq.exe

MD5 80505bab796b5f8b07f2605f98004e9a
SHA1 bd68a40ceaa8c591550ff6d71f53ad50ed3d4dcf
SHA256 8aca3c48d0f4cab0a260da546bc6c1a8b6092795136c85d01d9c05737ce62eca
SHA512 18a3ab2915201cfc3d28aaa98930cd2b68f131106f149f273641750f01f801c3d39fee562645b9c56c5fa2f37888a72299c80a45bb4301f8604403eb3881b399

C:\Windows\SysWOW64\bzczgsnf.exe

MD5 33c6a5706797ad2a928c349f503cde88
SHA1 fba28f4bcadb8146ea9b49ec6ed1ec1d18fe588d
SHA256 af57550ebfa29e04fb0f048727c184295f9a4272e588ddf8a671a2ceeaf699a6
SHA512 a7a5ff5f6561105f823f5967dd25134c22d271109dba5a9ab140a53616ab276c747da402a917a7b73e919a6649ea9b5a8632cccb214a6175a5d0a4db7e7ec512

C:\Windows\SysWOW64\hozzcgisstxja.exe

MD5 507f48b5818c4ff17e5dafc114d8b5dc
SHA1 1f505de258e869d2e051019fb29124fd1b6e7ed2
SHA256 0b4b10abe6806e35789fb36bf1caeca9be258c30e43772d6b9f7b7e7313d779c
SHA512 e1e03ece154f299dddc8d8c3ae63855de05f7a70c19af8db32e531f2a3f4b479243df209667ffd88d3940b0dae2ebc7158f77d95d018b8925e9605089f027dcc

memory/1756-35-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-37-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-36-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-38-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-39-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-40-0x00007FF9423B0000-0x00007FF9423C0000-memory.dmp

memory/1756-42-0x00007FF9423B0000-0x00007FF9423C0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 12b138a5a40ffb88d1850866bf2959cd
SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 b945c33a2156b021af3ecb42e37da43b
SHA1 f1fb48dcaa9201258761578b6bd8beb2de573b7d
SHA256 1043188e61918ce621d1c871757106539b09a1e904e143dd1fed26a507c9057d
SHA512 22105b329a033d6f94ee2da572c5feedc51c024f52c808bde88a68ef61a8016e9ff808694eb2ba18f87ff68d91a8e7af266c2099537e3643c3a31169b2c0e8f5

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 b39c08813d03683dc63ec1bfa2b38262
SHA1 eafe27bb713ed30b3a4167ec262199e3650c4a11
SHA256 97472e90db9f03f853d8366712d9f38f49ba07d7f52427b93417610569260e0c
SHA512 e08d6b261e3834a4e9dbeefc1262926e62460518cdac3eb036c2a379cab9eaa18d5b8d533ca38f6d0b8430237ef631ea0461a65665cb44346394c3277a449b11

C:\Users\Admin\Documents\CopyWrite.doc.exe

MD5 fd918876890e4c83566f17c5ba655c1a
SHA1 2a55e2a18f6ccdaff1a1289313f98120f61df76c
SHA256 ac28f95d03e537fa7ebec57496dbb2d9a0db59fd626c3e9c70d68ecc886949ab
SHA512 b78b6db6fc04dbc6089d89219312819deb6215eb3b8ddfeb2cb53ea4ff19d06920fb0464411c2c04623a6c25a41d33a16ca645a54ae02fe63f51fc7b00872873

C:\Users\Admin\Downloads\UnregisterResize.doc.exe

MD5 c871d43c9ff7a262b3cbd47bfbd3d373
SHA1 e7d8dd74e511841eb07c01934f157d938bb59868
SHA256 0209ae62f03806421d62a1ec0a9f5926e58856e4e059dfefc240c9c3ad0841ea
SHA512 78a36ebc85f0e0b960d8dd3a9a897b71ad36b50b97efbb6043dd1fc22327694addecb79417981b66a707f5de2081ff5e881858808f9c9e404cb200d83fcc410a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 f6b0c7517994393984eef9ae9e3a5ce3
SHA1 6d00f5c287ea55061163eb26284c6840e2e58a7d
SHA256 2150220fa6eef6419f7d31b50e1cf6581d18986727872be3fe7c8f7cb4265cfa
SHA512 f6a8c3f77c9ec33b239217370f3e31b874cf507bd149976c73bcfb76dae5127afd1ca93be8a75e9fa7b871fc98cd046fe8f7887b06e23e3ec8dfdf9139a07c95

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 14f795914f2e5d6cd30370cd3714c1bb
SHA1 dabf4881e37b518e340d1abe06ed9e7c3a98be77
SHA256 dddb43a22f6716bd701278525239fa2c4dcfaad55801582dffb422ed72d93a16
SHA512 0fd18398494c7ff53545483237f982e1933a449247998219bfc951b7f3cde848653f6cce8d39f6f079243f8c6446b21b641358bddcdb7fd21bfe7b708423f36e

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 8e9e5e033d48ab38acaddbbb8e48391d
SHA1 e13e549b7bb918f401c912db82af5db139a49d90
SHA256 869cb841438898858833e429811d9b5dd8ad5f50c33a92bc5a8ff553bd69f571
SHA512 db3a9360a7e6712c73a7b9af595bcebe23930be640e3677b518aff72650ed641ca70e585095569299d5e73ece260dd0599a9e0a084e095fb0867da473892f93a

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 c246b3334d235047e2d0b6541fa5bded
SHA1 fd3dd3a7a326b854af6d9d0cfd4181c35f7045ad
SHA256 906763649880d5d54714d85038d3216fee64b9714b17621c67cdcfec537783af
SHA512 69fbfd2423a14e43c0c07f7aa5b2a5dfd2b7a78e269e351c8b79cac0fc934dee8001685f99b5927407c8115ca73845bb2fd6a08139b48ca87c17a10beb55e11a

C:\Users\Admin\AppData\Local\Temp\TCD8B41.tmp\iso690.xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

memory/1756-602-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-603-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-601-0x00007FF944750000-0x00007FF944760000-memory.dmp

memory/1756-604-0x00007FF944750000-0x00007FF944760000-memory.dmp