Malware Analysis Report

2025-01-22 12:16

Sample ID 240625-k6s3da1arf
Target 0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118
SHA256 d26dc3afdc474fc8170c92fabdab98bf97176635d36fc3a1c8a7f76e77f43b6a
Tags
evasion macro persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d26dc3afdc474fc8170c92fabdab98bf97176635d36fc3a1c8a7f76e77f43b6a

Threat Level: Known bad

The file 0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion macro persistence trojan

UAC bypass

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Document created with cracked Office version

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 09:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 09:13

Reported

2024-06-25 09:15

Platform

win7-20231129-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Container = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Document created with cracked Office version

macro
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Enumerates physical storage devices

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 2824 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2824 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2824 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 2824 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
PID 1632 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1056 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1056 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1056 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1056 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\rundll32.exe

"C:\Users\Admin\AppData\Local\Temp\rundll32.exe"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 8.8.8.8:53 automation.whatismyip.com udp
N/A 127.0.0.1:80 tcp

Files

memory/2824-0-0x000007FEF571E000-0x000007FEF571F000-memory.dmp

memory/2824-2-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rundll32.exe

MD5 716d1b5f9d25d9374208ace7bfda7494
SHA1 e27e3c9551952c6b16664138ea6393682161bb51
SHA256 2b9fd5444bf32bb57619496751620b6f03d044e6a7d6c1ec734be1dbcbb477e5
SHA512 6016aac7c48d7d4a3b322ff77461b229fd6ec2915e4187a0f0259de0cb21446813dfe68d82a7216a21ac28de211e75ff1f0968d3869b0c454c78716cf7d74146

memory/2824-7-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

memory/1632-10-0x000000007409E000-0x000000007409F000-memory.dmp

memory/1056-11-0x000000002FFB1000-0x000000002FFB2000-memory.dmp

memory/1632-12-0x0000000000C10000-0x0000000000C28000-memory.dmp

memory/2824-13-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

memory/1632-14-0x00000000024B0000-0x00000000024F0000-memory.dmp

memory/1056-15-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1056-16-0x000000006E77D000-0x000000006E788000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc

MD5 7866ebcba567d0384a4173c44bde6163
SHA1 881da445f78b8ba92eddd7eb533dcb0027cd60f4
SHA256 ca193036f99a12ed1d89bc434d5b194631f83bc9bd6d4eba92e6403862c800ed
SHA512 c3fe4cbb393c72277855f8bbc657bbf6004b462a0ec9b2ca27c2a587055395b890b91a89a543ab33d058d864c636dc196b944ca1668515dd4f9bf2e9e8a4f9b5

memory/1632-26-0x000000007409E000-0x000000007409F000-memory.dmp

memory/1632-27-0x00000000024B0000-0x00000000024F0000-memory.dmp

memory/1056-28-0x000000006E77D000-0x000000006E788000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 aada3c138c52b61e44144116f98b4072
SHA1 f69251f21ee03cf47ad4e200f7b16b298ae2f436
SHA256 b46fd3bbef57bf177e8fb002c9592aa110490f9b718ff490c07deded84b20f57
SHA512 7dcf6c6b20348c945f4c899c08f9e701292c20838bf1467fbbdb74c0fb95f96bde611cef82c89067c898dacbe464c5d68123ee0713a0dfbea971e1cba8fa1c2b

memory/1056-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 09:13

Reported

2024-06-25 09:15

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Container = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Document created with cracked Office version

macro
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4060 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 4060 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 4060 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\rundll32.exe
PID 4060 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4060 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1620 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1620 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 1620 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\rundll32.exe C:\Windows\SysWOW64\cmd.exe
PID 3324 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3324 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3324 wrote to memory of 2712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0d8007c628a5c009d3d2b6aa53e6cc0a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\rundll32.exe

"C:\Users\Admin\AppData\Local\Temp\rundll32.exe"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc" /o ""

C:\Windows\SysWOW64\cmd.exe

C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 automation.whatismyip.com udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
US 52.111.229.48:443 tcp

Files

memory/4060-0-0x00007FFDE67B5000-0x00007FFDE67B6000-memory.dmp

memory/4060-1-0x000000001B050000-0x000000001B0F6000-memory.dmp

memory/4060-2-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

memory/4060-4-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rundll32.exe

MD5 716d1b5f9d25d9374208ace7bfda7494
SHA1 e27e3c9551952c6b16664138ea6393682161bb51
SHA256 2b9fd5444bf32bb57619496751620b6f03d044e6a7d6c1ec734be1dbcbb477e5
SHA512 6016aac7c48d7d4a3b322ff77461b229fd6ec2915e4187a0f0259de0cb21446813dfe68d82a7216a21ac28de211e75ff1f0968d3869b0c454c78716cf7d74146

C:\Users\Admin\AppData\Local\Temp\SENARAI CALON BN PRU 13.doc

MD5 7866ebcba567d0384a4173c44bde6163
SHA1 881da445f78b8ba92eddd7eb533dcb0027cd60f4
SHA256 ca193036f99a12ed1d89bc434d5b194631f83bc9bd6d4eba92e6403862c800ed
SHA512 c3fe4cbb393c72277855f8bbc657bbf6004b462a0ec9b2ca27c2a587055395b890b91a89a543ab33d058d864c636dc196b944ca1668515dd4f9bf2e9e8a4f9b5

memory/2664-25-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

memory/2664-24-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-26-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/4060-27-0x00007FFDE6500000-0x00007FFDE6EA1000-memory.dmp

memory/2664-30-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-31-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-29-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/1620-32-0x0000000000850000-0x0000000000868000-memory.dmp

memory/1620-33-0x00000000051C0000-0x000000000525C000-memory.dmp

memory/2664-28-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-34-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-38-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-39-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

memory/1620-37-0x0000000005810000-0x0000000005DB4000-memory.dmp

memory/2664-36-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-35-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/1620-40-0x0000000005260000-0x00000000052F2000-memory.dmp

memory/2664-41-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-42-0x00007FFDC1E80000-0x00007FFDC1E90000-memory.dmp

memory/2664-43-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-44-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-45-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-48-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/1620-47-0x0000000005450000-0x00000000054A6000-memory.dmp

memory/1620-46-0x0000000005160000-0x000000000516A000-memory.dmp

memory/2664-50-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/1620-49-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-61-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-62-0x00007FFE046ED000-0x00007FFE046EE000-memory.dmp

memory/2664-63-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/1620-64-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-65-0x00007FFE04650000-0x00007FFE04845000-memory.dmp

memory/2664-88-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-87-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-86-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-85-0x00007FFDC46D0000-0x00007FFDC46E0000-memory.dmp

memory/2664-89-0x00007FFE04650000-0x00007FFE04845000-memory.dmp