Malware Analysis Report

2025-03-15 07:57

Sample ID 240812-mcd3gawglp
Target 8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118
SHA256 e1b78d2e1c52b5e26e9d8ce84cf2ee145c5f0b24e76e56c6862f129b3d4f59a9
Tags
discovery execution persistence macro macro_on_action
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e1b78d2e1c52b5e26e9d8ce84cf2ee145c5f0b24e76e56c6862f129b3d4f59a9

Threat Level: Known bad

The file 8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery execution persistence macro macro_on_action

Process spawned unexpected child process

Blocklisted process makes network request

Suspicious Office macro

Office macro that triggers on suspicious action

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-12 10:18

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-12 10:18

Reported

2024-08-12 10:21

Platform

win10v2004-20240802-en

Max time kernel

143s

Max time network

139s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\explorer.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\books42\PVDSOVSB.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" \??\c:\books42\PVDSOVSB.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\testfile.css C:\Windows\System32\WScript.exe N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\help.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\help.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\books42\PVDSOVSB.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1792 wrote to memory of 4464 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\explorer.exe
PID 1792 wrote to memory of 4464 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\explorer.exe
PID 1796 wrote to memory of 2800 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 1796 wrote to memory of 2800 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 2800 wrote to memory of 2424 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 2800 wrote to memory of 2424 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 2800 wrote to memory of 2424 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 2424 wrote to memory of 1864 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 2424 wrote to memory of 1864 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 2424 wrote to memory of 1864 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2000 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2000 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1864 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1864 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1864 wrote to memory of 3564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1864 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4564 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4564 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4564 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118.doc" /o ""

C:\Windows\explorer.exe

explorer.exe C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe"

\??\c:\books42\PVDSOVSB.exe

c:\books42\PVDSOVSB.exe

C:\Windows\SysWOW64\cmd.exe

cmd /ccmd /cHELP&help&cmd /cru..................................jse&help&exit

C:\Windows\SysWOW64\cmd.exe

cmd /cHELP

C:\Windows\SysWOW64\help.exe

HELP

C:\Windows\SysWOW64\help.exe

help

C:\Windows\SysWOW64\cmd.exe

cmd /cru..................................jse

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru..................................jse"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 92.123.26.217:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
GB 95.101.28.35:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 217.26.123.92.in-addr.arpa udp
US 8.8.8.8:53 35.28.101.95.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
NL 188.116.36.143:443 tcp

Files

memory/1792-0-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-2-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-3-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-4-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-1-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-5-0x00007FFE91A2D000-0x00007FFE91A2E000-memory.dmp

memory/1792-7-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-6-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-11-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-12-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-10-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-13-0x00007FFE4F9B0000-0x00007FFE4F9C0000-memory.dmp

memory/1792-9-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-8-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-16-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-19-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-22-0x00007FFE4F9B0000-0x00007FFE4F9C0000-memory.dmp

memory/1792-21-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-20-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-18-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-17-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-15-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-14-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 eec81267edb61cbbe017888140bc6d2e
SHA1 ad77e1c3994f68a45edc5387157a9bee90017a5e
SHA256 f5510d5779d7fef807bf374ebd1de7711019c50ec83e0306db37b652e16e42ed
SHA512 4b551373b537bb39fa48a75477870707e6de6c6e75d62386e033f8b6c0765db157c2b4c43f78094a38a8ef3d0142d47f151a9688be35e10d59459c0553381678

C:\Users\Admin\AppData\Local\Temp\TCDE046.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

memory/1792-183-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-188-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-195-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-196-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-199-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-198-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-206-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe

MD5 ccf010c91f25ecb4215099253202fc1d
SHA1 35112147597fc24c3eb8191d4aeea3dcfc54d4cf
SHA256 26480d04d3886ef08047d82e1c60f7795e634fad68b1f68d905c8ca2984e6ee3
SHA512 52a12cb90a436fe6520e80a7552b143b1a60495ff922d5aa1d804b9606a38a3ffb94d19c41972deeea89d13d4f22960e78448617724a9816577937322632000e

memory/1792-228-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-227-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-226-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

memory/1792-229-0x00007FFE91990000-0x00007FFE91B85000-memory.dmp

memory/1792-225-0x00007FFE51A10000-0x00007FFE51A20000-memory.dmp

C:\books42\PVDSOVSB.exe

MD5 3720523ef42644b37bc895d47b1a5850
SHA1 1b4f5b49eff04cd2b50fcf230c2caaa200701097
SHA256 3320ddfa73df3e02e6daf617ae73cdff1575eeba72da735123c94ed567fce536
SHA512 f2db1b80ed3ac68e71b745f4b4f03a08268dd1959a2ab05592abfefbec9f13f805bf23d6e8459873f6e579d80d1f673978d048ac74b1dd21cd7a144bbdc5a515

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru..................................jse

MD5 9e4a5826a1a1cf37b3027322a8e74486
SHA1 b0b9dff61fcdbc511c4334140560dbda591ba128
SHA256 72cd89c71677d1817c44ce69177bd32e9ffc51f41c9cb7357fcfd16323a93762
SHA512 eb19a8a7fda6d9e39620465d8a216d109fff57539f1fd7ae478267b7944f27d93dfe819246260852334d42eff92cf369fe97e75641bbfb04f13d1535fc79bd34

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-12 10:18

Reported

2024-08-12 10:21

Platform

win7-20240729-en

Max time kernel

140s

Max time network

140s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\explorer.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\books42\PVDSOVSB.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A \??\c:\books42\PVDSOVSB.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" \??\c:\books42\PVDSOVSB.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\testfile.css C:\Windows\System32\WScript.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Command and Scripting Interpreter: JavaScript

execution

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\help.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\books42\PVDSOVSB.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\help.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A

Office loads VBA resources, possible macro or embedded object present

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\0\win32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\HELPDIR C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\ = "Microsoft Forms 2.0 Object Library" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\FLAGS C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8}\2.0\0\win32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\TypeLib\{9F9FBA83-6EC9-492C-A91B-5EC69FE4A0C8} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 2736 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2436 wrote to memory of 2736 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2436 wrote to memory of 2736 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2436 wrote to memory of 2736 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2436 wrote to memory of 2420 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2420 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2420 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\explorer.exe
PID 2436 wrote to memory of 2420 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\SysWOW64\explorer.exe
PID 984 wrote to memory of 896 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 984 wrote to memory of 896 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 984 wrote to memory of 896 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 896 wrote to memory of 1716 N/A C:\Windows\System32\WScript.exe \??\c:\books42\PVDSOVSB.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2120 N/A \??\c:\books42\PVDSOVSB.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 1876 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\help.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 2780 wrote to memory of 2212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8e5aacbc0e4ff084a0193ba315167f2b_JaffaCakes118.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\explorer.exe

explorer.exe C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe"

\??\c:\books42\PVDSOVSB.exe

c:\books42\PVDSOVSB.exe

C:\Windows\SysWOW64\cmd.exe

cmd /ccmd /cHELP&help&cmd /cru..................................jse&help&exit

C:\Windows\SysWOW64\cmd.exe

cmd /cHELP

C:\Windows\SysWOW64\help.exe

HELP

C:\Windows\SysWOW64\help.exe

help

C:\Windows\SysWOW64\cmd.exe

cmd /cru..................................jse

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru..................................jse"

Network

Country Destination Domain Proto
NL 188.116.36.143:443 tcp

Files

memory/2436-0-0x000000002F1A1000-0x000000002F1A2000-memory.dmp

memory/2436-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2436-2-0x00000000739FD000-0x0000000073A08000-memory.dmp

memory/2436-5-0x00000000739FD000-0x0000000073A08000-memory.dmp

memory/2436-6-0x0000000008040000-0x0000000008140000-memory.dmp

memory/2436-65-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-80-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-91-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-55-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-56-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-57-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-58-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-59-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-60-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-63-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-62-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-61-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-69-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-79-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-90-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-151-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-103-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-102-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-101-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-100-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-99-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-98-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-97-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-96-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-95-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-94-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-93-0x0000000000550000-0x0000000000650000-memory.dmp

C:\books42\sdvvbyriojklhsfsdfcvberhrjkr.vbe

MD5 ccf010c91f25ecb4215099253202fc1d
SHA1 35112147597fc24c3eb8191d4aeea3dcfc54d4cf
SHA256 26480d04d3886ef08047d82e1c60f7795e634fad68b1f68d905c8ca2984e6ee3
SHA512 52a12cb90a436fe6520e80a7552b143b1a60495ff922d5aa1d804b9606a38a3ffb94d19c41972deeea89d13d4f22960e78448617724a9816577937322632000e

memory/2436-92-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-89-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-209-0x00000000739FD000-0x0000000073A08000-memory.dmp

memory/2436-88-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-87-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-86-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-85-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-84-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-83-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-82-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-81-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-78-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-77-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-76-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-75-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-74-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-73-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-72-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-71-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-70-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-68-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-67-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-66-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2436-64-0x0000000000550000-0x0000000000650000-memory.dmp

C:\books42\PVDSOVSB.exe

MD5 3720523ef42644b37bc895d47b1a5850
SHA1 1b4f5b49eff04cd2b50fcf230c2caaa200701097
SHA256 3320ddfa73df3e02e6daf617ae73cdff1575eeba72da735123c94ed567fce536
SHA512 f2db1b80ed3ac68e71b745f4b4f03a08268dd1959a2ab05592abfefbec9f13f805bf23d6e8459873f6e579d80d1f673978d048ac74b1dd21cd7a144bbdc5a515

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ru..................................jse

MD5 9e4a5826a1a1cf37b3027322a8e74486
SHA1 b0b9dff61fcdbc511c4334140560dbda591ba128
SHA256 72cd89c71677d1817c44ce69177bd32e9ffc51f41c9cb7357fcfd16323a93762
SHA512 eb19a8a7fda6d9e39620465d8a216d109fff57539f1fd7ae478267b7944f27d93dfe819246260852334d42eff92cf369fe97e75641bbfb04f13d1535fc79bd34