Malware Analysis Report

2024-11-13 14:27

Sample ID 240613-fev1faybqm
Target a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118
SHA256 d35754568c165dbe399f20e5783bed3a45196b1b864ad8ed76892f56dafbfcb5
Tags
evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d35754568c165dbe399f20e5783bed3a45196b1b864ad8ed76892f56dafbfcb5

Threat Level: Known bad

The file a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence spyware stealer trojan

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Disables RegEdit via registry modification

Loads dropped DLL

Checks computer location settings

Windows security modification

Reads user/profile data of web browsers

Executes dropped EXE

Enumerates connected drives

Modifies WinLogon

Adds Run key to start application

Drops file in System32 directory

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 04:47

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 04:47

Reported

2024-06-13 04:50

Platform

win7-20240611-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\djgxhgpg = "hygtxrkcds.exe" C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewxiylud = "nngpkojufhhuplf.exe" C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hbqrawwfhyygp.exe" C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\i: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\hygtxrkcds.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\ymvfdpga.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\hygtxrkcds.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\hygtxrkcds.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nngpkojufhhuplf.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\nngpkojufhhuplf.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ymvfdpga.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hygtxrkcds.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ymvfdpga.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hbqrawwfhyygp.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\hbqrawwfhyygp.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\hygtxrkcds.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A
File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\ymvfdpga.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
File opened for modification C:\Windows\~$mydoc.rtf C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC2B15C4493399D53CAB9D23292D7BC" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FFFC4F5882139140D6207E92BD92E1435837664E6342D6EB" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\hygtxrkcds.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\hygtxrkcds.exe N/A
N/A N/A C:\Windows\SysWOW64\hygtxrkcds.exe N/A
N/A N/A C:\Windows\SysWOW64\hygtxrkcds.exe N/A
N/A N/A C:\Windows\SysWOW64\hygtxrkcds.exe N/A
N/A N/A C:\Windows\SysWOW64\hygtxrkcds.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\ymvfdpga.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\hbqrawwfhyygp.exe N/A
N/A N/A C:\Windows\SysWOW64\nngpkojufhhuplf.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2160 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hygtxrkcds.exe
PID 2160 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hygtxrkcds.exe
PID 2160 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hygtxrkcds.exe
PID 2160 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hygtxrkcds.exe
PID 2160 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\nngpkojufhhuplf.exe
PID 2160 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\nngpkojufhhuplf.exe
PID 2160 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\nngpkojufhhuplf.exe
PID 2160 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\nngpkojufhhuplf.exe
PID 2160 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 2160 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 2160 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 2160 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 2160 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hbqrawwfhyygp.exe
PID 2160 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hbqrawwfhyygp.exe
PID 2160 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hbqrawwfhyygp.exe
PID 2160 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\hbqrawwfhyygp.exe
PID 1100 wrote to memory of 2392 N/A C:\Windows\SysWOW64\hygtxrkcds.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 1100 wrote to memory of 2392 N/A C:\Windows\SysWOW64\hygtxrkcds.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 1100 wrote to memory of 2392 N/A C:\Windows\SysWOW64\hygtxrkcds.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 1100 wrote to memory of 2392 N/A C:\Windows\SysWOW64\hygtxrkcds.exe C:\Windows\SysWOW64\ymvfdpga.exe
PID 2160 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2160 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2160 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2160 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2524 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2524 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2524 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2524 wrote to memory of 2044 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe"

C:\Windows\SysWOW64\hygtxrkcds.exe

hygtxrkcds.exe

C:\Windows\SysWOW64\nngpkojufhhuplf.exe

nngpkojufhhuplf.exe

C:\Windows\SysWOW64\ymvfdpga.exe

ymvfdpga.exe

C:\Windows\SysWOW64\hbqrawwfhyygp.exe

hbqrawwfhyygp.exe

C:\Windows\SysWOW64\ymvfdpga.exe

C:\Windows\system32\ymvfdpga.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

N/A

Files

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

memory/2524-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Windows\SysWOW64\hbqrawwfhyygp.exe

MD5 e2a407c7e6d208755fd796d345cc6c1a
SHA1 fa4e17a72fbd90926b7e17a129e871b43d04c586
SHA256 57b903d9c284a91e96659d6a8b7db6748e00e26971e4b56282ea022948ee61ce
SHA512 6ea6cace7c8442dcc87e462d896958bce4c85abaa1670e439638202e97ff35e463f1e229ddbbf25aaa55a09b8b6db84647c2911c61d73901c3cc913db2658793

C:\Windows\SysWOW64\ymvfdpga.exe

MD5 50319c4cba3f9b0198b4f2bb6e4dba7d
SHA1 b56236071692b79f8071d7149ac430d66326231f
SHA256 4c7451578c633d354d6704effda029358a3eb9a3e9bccb46e8643ba9d9f0048b
SHA512 78fc3c2606170b8ffc918374be3d2d2687a66c7374adee6c24a9a25c42a6cdfb8c4a0c777b8681411b7c48247de8bfd03015f44e4ed2f0ddfa0a225c3908c6d3

C:\Windows\SysWOW64\nngpkojufhhuplf.exe

MD5 5a1f1ffa03d42288b8412dd69f6146e3
SHA1 66638c283896e8a6b22fcc8a1aae2f5bbb4bab6b
SHA256 1d713b04aa8145d3722eafad067576661288fd11538ff98b4461565e3deffdc1
SHA512 88a8557403f13d577e39630dc610e0b808a685f348960fae3628e6bfc6edc2f11b88243a72a2324b7e169bce5ad0040744bf04d138ed4669fe350f407c1425d3

C:\Windows\SysWOW64\hygtxrkcds.exe

MD5 0267f2d4d4e116591a18f1a13d464442
SHA1 cbbac35a1ee80c946ed63caae69bb4a8a14e7c86
SHA256 8ec515503cca2b6096cd6975465057a025b2ccc88dcdcf52fa02f573a298e7f7
SHA512 ff95f3e59d0fd7053eaa4068c750ab7c9c7592f1077a790ce31a51339e1ef28bcc0ca23496e51778593d7127b7b194578b03faee9ab18dabf41e48c48df35343

memory/2160-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

MD5 44f6def66812f7c6b9ca27c4804141b1
SHA1 5c8cac48baa288f2e4c5135e2dee846c3eca5b5b
SHA256 6fa1fdabb5ec8f6a97c0ffc9b9b2c599d1ac28a630d9dfd9878e3a17f065906c
SHA512 947dbc6f105760d6ce9c5fb7973c5bf78d94f54d775136c5b62ae46b2bbfa05a7261358ffbd97e0a136d4a39149ba01d1b88b539cd59703c26b5b058d8ce73aa

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 ac8204f7a8c3e8c63e19ababb8d026b4
SHA1 624e19d657080587d2a15828809545aa644018c7
SHA256 61c7fc6abbea8a0affe59d12867bb04716b39f8a468130beca818cd7f0aabc02
SHA512 4cbfe88b9931a1767fce14a4641707a78449d1d51f9d00534b7e0529e63754394cff55b70ef39cb868c24c1d009ba9965fb36137e9aa8c0024697f0d8bba20b5

memory/2524-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 04:47

Reported

2024-06-13 04:50

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe"

Signatures

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\jmuanrtted.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\jmuanrtted.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qprakwbf = "jmuanrtted.exe" C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xxadzuye = "vzocqspvvuegchu.exe" C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cbisjjfmrzuia.exe" C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\q: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\jmuanrtted.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\jmuanrtted.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\jmuanrtted.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\jmuanrtted.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\cbisjjfmrzuia.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created C:\Windows\SysWOW64\jmuanrtted.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\vzocqspvvuegchu.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\bnvpakjt.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\bnvpakjt.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\cbisjjfmrzuia.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\jmuanrtted.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created C:\Windows\SysWOW64\vzocqspvvuegchu.exe C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\bnvpakjt.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFFFC482982129132D72D7D93BDE0E630583666426337D7EC" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\jmuanrtted.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\jmuanrtted.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\jmuanrtted.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302C0C9D2C83276A3277D277222DDA7DF464DD" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15D449338E253CFBAA0329FD4BB" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F068B5FF6621D9D27BD1A98A7B9117" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\jmuanrtted.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAF9BEF962F1E3840E3A42819B3E97B38903F14314033EE1CD42E809D6" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1948C77915E3DABFB9CE7FE1EC9734CC" C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\jmuanrtted.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\cbisjjfmrzuia.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\vzocqspvvuegchu.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A
N/A N/A C:\Windows\SysWOW64\bnvpakjt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\jmuanrtted.exe
PID 972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\jmuanrtted.exe
PID 972 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\jmuanrtted.exe
PID 972 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\vzocqspvvuegchu.exe
PID 972 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\vzocqspvvuegchu.exe
PID 972 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\vzocqspvvuegchu.exe
PID 972 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\bnvpakjt.exe
PID 972 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\bnvpakjt.exe
PID 972 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\bnvpakjt.exe
PID 972 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\cbisjjfmrzuia.exe
PID 972 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\cbisjjfmrzuia.exe
PID 972 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Windows\SysWOW64\cbisjjfmrzuia.exe
PID 972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 972 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 3344 wrote to memory of 4544 N/A C:\Windows\SysWOW64\jmuanrtted.exe C:\Windows\SysWOW64\bnvpakjt.exe
PID 3344 wrote to memory of 4544 N/A C:\Windows\SysWOW64\jmuanrtted.exe C:\Windows\SysWOW64\bnvpakjt.exe
PID 3344 wrote to memory of 4544 N/A C:\Windows\SysWOW64\jmuanrtted.exe C:\Windows\SysWOW64\bnvpakjt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a3de7251d0458eb2be565d7d8fa507b5_JaffaCakes118.exe"

C:\Windows\SysWOW64\jmuanrtted.exe

jmuanrtted.exe

C:\Windows\SysWOW64\vzocqspvvuegchu.exe

vzocqspvvuegchu.exe

C:\Windows\SysWOW64\bnvpakjt.exe

bnvpakjt.exe

C:\Windows\SysWOW64\cbisjjfmrzuia.exe

cbisjjfmrzuia.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\bnvpakjt.exe

C:\Windows\system32\bnvpakjt.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp

Files

memory/972-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\vzocqspvvuegchu.exe

MD5 b4fed0cd0bec5b6e467ba52e251898f6
SHA1 735be4416fc460abcaea2e56f46d25ffc14a2c0c
SHA256 3393cd76725ee88dadac0c9864b11a2d0c2a0ef9e2d6a89a6383a751139f0d10
SHA512 ae19c04c3fa2e05808f722ac5ee3a68214908ca8a7924d12ada4cb13f72d59d728455aecbc6f39d3324044d4484fee9ae007d15d043bd9a6d7200d1d47bff03d

C:\Windows\SysWOW64\jmuanrtted.exe

MD5 b0b5795b78f341b74a5f3e03cf8750ac
SHA1 55da1f5a7f09a0383929a233a480407e27ca855a
SHA256 e7b64efbb8c98151ef77f498bb67befeddbb5ff8dbad0b08245535e2d6968a20
SHA512 c474fe6fe8d358f3102d3c68bcb40b5b1661b5a4b5c5aa716bbae79e784314107820704cb94f35d47ae0229389bf6ad28e0486c5ae40f0e6aeb6b5532271bb09

C:\Windows\SysWOW64\bnvpakjt.exe

MD5 e68d4bab895a85a6d99fadfd857006e4
SHA1 81d64cb60cd8c428025e4d4b304885be0363e4a6
SHA256 0058b8c3160aff7dc8f5d62969e82185f5d59845cb8bf59f1ef84572a980197c
SHA512 59c760ceb35744521724054c098906a14b0c25b608d783e22b36065b2cf4970406d04c2955af5028eed909d30c59323cdacdf94b73e2c32ccadbfcac89927f2c

C:\Windows\SysWOW64\cbisjjfmrzuia.exe

MD5 e915394999bcf77d6f10ecd1993dab02
SHA1 04e344d18dabcfef8b53cc994400f6edf6d596f6
SHA256 58be5b03b23678f44e3cc5e7b0695bdbba838fae63a3401c2a52b11fbac91644
SHA512 fe167cb9c2f3d5019e2ef98f31620fa86cedff9563283146556f0686fd6d2dd433e5bc5cbf454eaf96b8155681b882bfc4c61e329faf137737b13ac188b00f95

memory/2444-38-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-36-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-40-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-37-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-41-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-42-0x00007FF8708E0000-0x00007FF8708F0000-memory.dmp

memory/2444-43-0x00007FF8708E0000-0x00007FF8708F0000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 c7667c3371d5d84c2c3d9801baa3dc0f
SHA1 25838b0056cd399422f492754b6437a95f318e52
SHA256 5596446f922d237efed146d488ec6e529f0d66a064960eeb6013773cfa45ab9d
SHA512 7e42fc3aad97260c7973eb4adb8dca390a207f2f8dee0c45f74e7e91441d9f548aa8ae03f7f6109e772bc67a8e6124e74bc37a0496120a0200f58d9e96451a09

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 5fd079560259c99fa2e8c7ce26a9a9c3
SHA1 0f4be585acbbf7acbf3538cbeabfbe72237738d7
SHA256 2060f39d45395d6e36251d28ff8e173ee6528111316db3cdc9de7073bfedad38
SHA512 0f5ab3a1e9fd93126d09fc0330c695f41422a6ad47b02e7554307b155bddb77d8bf94f1d94dd1d931d5878c4e2049e7c9ecabf8bc7c7a5b10667cd9cb3f45b12

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 52c0d1d70562d836c33eb8f11bb6a44f
SHA1 e7a9c86c317597ef79a4ef99bcb513e0d3fd0531
SHA256 29ad5e1e50e64a6570455bac227418a03f3ed15d131fc85d605b847fa9e66f15
SHA512 f571e34461d3e889a6e09cb5c8c3b9426373280d3aefa8db944f793f3671f9a14b9cbb5387a1c1a52015feae8642c4b2201d6ba06042105f38b73dec432cb060

C:\Users\Admin\Documents\CopyRead.doc.exe

MD5 7417b59e219b3201e39920be3f819003
SHA1 8f941ed282726f80eb6e8347de24f3bc7df92e00
SHA256 a5cda9f8e10c80c8806e08fc2f3d2a5a36c58201d6317ca6f60bc1e877fcfa79
SHA512 6f8217226f07e171b30ac3999025a2a75efcf1f1f2bfd131aa2e03814bd44f4755e3cf00db8c6891d83ec593d11e39ddecbe6af30ddecfb36a9e9ad0e2342235

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 4bc6f56ff8351d6f6134c65cd8f50526
SHA1 4e70609de0d4373aad79b69e69d831546a45c064
SHA256 cd09358de2d7a02a3699e49168c2cbeef3fff0c8603a4a7da037c0e115a303d6
SHA512 872dfc910df9ab64a4b72208cab7b1046c15752610969373db2d39dac5fdf87571cbc0c42e109c2c8fa7d570e30017eb0cc5b939f3d5a531c65459aa5e3ba33b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 572e32a6eeb59d8b39bb6c8adb3fad88
SHA1 9fa0d9577a50954cfdbf4451079a95e8e075f944
SHA256 88cb066e83a2b63ecf91f3eb6e2c44c6e5fa85872504ce33d18bf2d27d84ab75
SHA512 99e7e567ee0d14ef3ff07b8b39c97ae36d13851976bb1c9583e2d1d1b1d1a4f89994b89aff5d3343195e44ce2245a59fe58d34624e794ed75bd0c88600acec96

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 09216370719345370b903ec2928f11de
SHA1 d44aafd417bb399b34635e6a5baf67d34e857c71
SHA256 c2d8de36cbba2566ce0504fac32d8a4fe8621b602f934491d8d4820129c3d67f
SHA512 e63245eb90c8c1f50a18bd694cba523a8677bbb6f602c0f331ecd7616553989476649aa9cdf7b26fb428f3e9bd51e6298dd871c8ea598caab76f4a7cff84d3d2

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 8625e2fed627b011717db9c18c658329
SHA1 b22bd00f8286b9a9b6c729a1b8a9fe0d50775fe8
SHA256 d4c6f13b27efbf0e66152b975af800e7a49efa47ff51859adfd82793737177fb
SHA512 6e5e5351a663ce622e703a7b54532de8bb0f205f2616f8872fe963f769a4572875756f3ff6ebb3127778c076d982295526a55e60cee9456e75f8fab9821562da

memory/2444-121-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-122-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-120-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp

memory/2444-123-0x00007FF872DB0000-0x00007FF872DC0000-memory.dmp