f75b7535365c80c14523f074f5007fc6769e0453562d369362dff9c7e52874e5

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
Size

11KB
MD5

fbcff06b38e4ac7bcb904bdad1f9bdb9
SHA1

b4844e4398344a035507bb085353d8cce62739cd
SHA256

f75b7535365c80c14523f074f5007fc6769e0453562d369362dff9c7e52874e5
SHA512

29399e1558e4cffc128b38ba87d39d82184a971c4ab4baefc5ce452d9e03ce8f8515e9b41dc1038df65c11bbaec08200da42dfdc631820a1ea945b2ec4959a1d
SSDEEP

192:S06iazzoKkrt/F53lGHuL3/E/GCizES4TN/o/04qcB6bdhSz46OXddIxa4sy6kp:S06ih3t/rgOL3/EZiw5o0AadUz46OXdg

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Drops file in Drivers directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "ÏµÍ³ÉèÖÃ"	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%SystemRoot%\\system32\\exloroe.exe"	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3296-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000100000000002b-7.dat	upx
behavioral2/memory/3296-343-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3296-4822-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.19041.1_none_905c6a851ca62951\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme2\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme1\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.19041.1_none_923716ddadd939c8\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.19041.1_none_d9f53b39b3834744\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.19041.1_none_3802d0d85b60df4c\autorun.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\autorun.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	F:\autorun.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\atl110.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\en-US\wiadss.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\legacy\rac-generic-private.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winmsipc.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\mstask.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\adprovider.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-Common-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0211~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilter-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\WceISVista.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteFX-HyperV-Integration-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB4537759~31bf3856ad364e35~amd64~~10.0.1.0.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\odbcconf.exe.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDUSL.DLL	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\acppage.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\AudioEndpoint.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\jscript.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\sdstor.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\sisraid2.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\fetn63a.sys	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ETWESEProviderResources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Containers-Guest-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netavpna.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gameux.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\XPSViewer\ja-JP\XPSViewer.exe.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\mmcshext.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netevbda.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientLocalUI-D-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Group-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\onexui.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wtsapi32.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}4105.bin	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\th-TH\windows.ui.xaml.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\MSFT_WaitForSome.schema.mfl	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\iaLPSS2i_GPIO2_BXT_P.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\netnvma.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\srmshell.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Virtualization-RemoteFX-User-Mode-Transport-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\nete1g3e.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\SmbBandwidthLimit.cdxml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WINSRPC.DLL	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\ufxchipidea.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP-manifest.ini	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\sisraid4.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterVmq.Format.ps1xml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-63-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dmcompos.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Dism.exe.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\VES-Disambiguation.0409.grxml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx2-OC-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\mdmpace.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\wevtfwd.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\eapphost.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\VirtualSmartcardReader.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\wmitomi.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nlaapi.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\175.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-colorize.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-16.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\OneNoteAppContracts.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\SourceAppService.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-200.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-200.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-400.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaremr.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-200.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-black.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\DeleteToastQuickAction.scale-80.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_bg.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\185.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-150.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\IsoLeft.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_wel_motionAsset.m4v	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64_altform-lightunplated.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado28.tlb	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\ImportFromDevice.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-72.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-unplated_contrast-white.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_altform-unplated_contrast-black.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\ui-strings.js	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-400.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1_none_ab1cdb679f059ace\pcwutl.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mlang_31bf3856ad364e35_10.0.19041.746_none_3f2d4097772e54ff\f\mlang.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1033\alinkui.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.19041.1266_none_153dc4c3b9f13a6f\ci.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nifests-onecorebase_31bf3856ad364e35_10.0.19041.746_none_dd92b0d44ce363ab\mup-replacement.man	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mapcontrol_31bf3856ad364e35_10.0.19041.1202_none_9269f331f42a1765\MapControlCore.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_55752eff5e7e1565\wdmaud.drv.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-docprop.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bfce1fe5bc80bb98.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..ces-serverlicensing_31bf3856ad364e35_10.0.19041.1_none_a7ba8461d4d5f4b9.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-qos-adm_31bf3856ad364e35_10.0.19041.1_none_89d4812563ddb6c1\QOS.admx	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..inrt-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_6dd06b57074d7979.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-basedependencies_31bf3856ad364e35_10.0.19041.1_none_c2e7a999fc8db0b6.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_msmq-driver-deployment-languagepack_31bf3856ad364e35_10.0.19041.1_es-es_4d22a6a01df2e39a.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\diagnostics\system\Power\fr-FR\DiagPackage.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_1394.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_a556c45e8b680b98\1394.inf_loc	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..d-library.resources_31bf3856ad364e35_10.0.19041.1_en-us_6b197ad8f6377bcb\Windows.UI.PicturePassword.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-refsutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d95dc3069abe8236.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..osoftaccountcloudap_31bf3856ad364e35_10.0.19041.423_none_281093d42ab395f7.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\OkDone_80.png	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_c413487bfdbf0ab34e81a4fb6f95b58c_31bf3856ad364e35_10.0.19041.1220_none_0ec4d3dd6aafcd6d.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.19041.1_en-us_26a4e6c8a1381605.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-homegroup-controlpanel_31bf3856ad364e35_10.0.19041.746_none_9e82b4275481e1ba\hgcpl.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dssetupcli_31bf3856ad364e35_10.0.19041.546_none_d7336849176fde95\f\dsrole.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-peerdist_31bf3856ad364e35_10.0.19041.1151_none_91f4a96c9f464c76\f\PeerDistSvc.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_0af4ba380f3bcf69\whqlprov.mfl	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..imeserver.resources_31bf3856ad364e35_10.0.19041.844_en-us_1d267af587f56b9c\r\assignedaccessmanager.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..ernal-adaptivecards_31bf3856ad364e35_10.0.19041.1_none_730c46ad4e9db2d8\Windows.UI.Shell.Internal.AdaptiveCards.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.19041.1_es-es_32875f533521a9ea.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing\Sessions\31100112_89286732.back.xml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppxManifest.xml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_nvraid.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_6eb421edad0bca03.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_it-it_0d9052e350483924\createPermission.aspx.it.resx	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_wceisvista.inf_31bf3856ad364e35_10.0.19041.1_none_7027182b5e87323d\WceISVista.inf	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..qos-pacer.resources_31bf3856ad364e35_10.0.19041.1_es-es_a107b29eb32c7d51\pacer.sys.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-signalmanager_31bf3856ad364e35_10.0.19041.264_none_bcf75b4aec20c233.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.19041.264_none_0d7b2f9f635b8d49.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\msil_system.data.entity.design.resources_b77a5c561934e089_10.0.19041.1_en-us_f063c9bd0eef4d6a.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-tapi3_31bf3856ad364e35_10.0.19041.746_none_4996a6e922c0747b\tapi3.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Basic~fi-fi~1.0.mum	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing\Packages\HyperV-VmTpm-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-azman.resources_31bf3856ad364e35_10.0.19041.1_en-us_c7a697ad09c27813\azroles.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-onesettings-client_31bf3856ad364e35_10.0.19041.1081_none_707e08cfb7595994\OneSettingsClient.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.19041.264_none_33cd145286244f7a.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..istfolder.resources_31bf3856ad364e35_10.0.19041.1_en-us_b8fc917c15baa796.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f15c2f5815b5c92d\TipTsf.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.19041.1_en-us_d9389be11d868c46\smtpcons.mfl	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-winrt-windowsgraphics_31bf3856ad364e35_10.0.19041.264_none_e7a7ff8203ef827a\f\Windows.Graphics.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_a2fa28d9db4c0081\w32tm.exe	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_networking-mpssvc-netsh.resources_31bf3856ad364e35_10.0.19041.1_de-de_f3914308c2a0d4de\fwcfg.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_system32_wbem_fr-fr_45318c94b21276b4.cdf-ms	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..datastore.resources_31bf3856ad364e35_10.0.19041.1_it-it_c9ce7fb39e1d55da.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_mssmbios.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8705544587370182.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Data.resources.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e8440c09eef3f557\CvtResUI.dll	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps.resources_31bf3856ad364e35_10.0.19041.1_es-es_f85bc4532ee87d3f\hidphone.tsp.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1023_nl-nl_348ed0341bb1fbff\comctl32.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\ShouldContain.snippets.ps1xml	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_10.0.19041.1_en-us_86cec2673098cffa\FntCache.dll.mui	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_37a8fc596f462cbc\12.js	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.1266_none_eb43a8b5fb8e05e3.manifest	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4888	3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe	86
PID 3296 wrote to memory of 4888	3296	fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Modifies Installed Components in the registry
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Jilu.txt

Filesize
4KB

MD5
17ac4cb365920e2d43bd1e9cbbb1dd33

SHA1
210234702c0baa07c10d8953e85d8d10458cfb0e

SHA256
64b5269b2e5b9fb6e3f751c4acf9eba8c49d1ab2f426b9b54f691fe80a03e233

SHA512
52a18901e8bf07ae43160c78004c1a31a884f51bddffe4b5d0920fb86f3a70733b65ee9a9360f72ae934961f3dfe7d9dc415191ec49d8e6c57ea3ff05b5bbd88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
bf6f6901b7f70ad8842fc2f3be213aa6

SHA1
e45bded84c4fc25f84004afba058b0097799af8e

SHA256
d9328d2967b697533ec040317dd70e3651c9a44210da1ed978a4b8e5597dc2ee

SHA512
6839ca885820f8ba901147a725618b8fcba46c02a1bfea02c34b0d32c3017a62ecd6bb93c7046d88e77cb730d986dccc1da6360e2aad871321f0e4724ccb6cf0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
3dc3ec21e9edd8c9d2d52c6ce0bb3e5a

SHA1
a0ac3f8a970e1ff5d8bb86d2a7be0926cda8ad0d

SHA256
b2acad5ce3e2060b8f92e1421e253b432c255cb8867de1db6115702afd2f3fc5

SHA512
c714028e16f50b2aa9511701f52b2d9e7b8d0f2bf07dc0e226d2002b09d7b72a64445737f3c0054b5d3d9faa4d043323a10f262fb9cba74bb3a7adde5bd60001

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
55eae5d2fb72223fa3fe71d82745bd9f

SHA1
de9f7907ffb13acc83f17594ab1d34d596144cf8

SHA256
79141e881a5abb763614dac04b029e645cfa4d1f1a3623f1048c657e2fe4a4cf

SHA512
55f4511499f628485aaa79baa528bf3a981a5db7912445394b98540a6fe8789c768eb3dc760ef8e37665ed0d8f345c110657684d11fdef8b4c8d50f4766b2a9f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
0e1dbac67a1c5a71c49d0c5e1fde8b59

SHA1
2e88debe7ebf900a8b3e618d12ebe0bc3eb929a1

SHA256
d0f5a0a25faf3d12565292f5b38848ca53b5397af0b7529d259e36b9d21eef35

SHA512
2bf3c1bd7095dd39c0c8db9d5811a54c4f3ea94e4607d5c5606bfaeffd5cf1df64d1a6b14e10ec4628d53cc94fc0472eb619469faf224cb2deeec42c15deae66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
edf0afdc0128d7f629fed0faf2579a81

SHA1
e5aee733e3dce326f122c2c3c35a7359b1754fcb

SHA256
800ce0a74b1cec0e7f13290432c7de48f90f7efabf1003db8e87ddc5b7cf7a52

SHA512
5ff249e68d50bdacaec6e9d4c0c1c37cbcb9ff29682cd09dd7a53ece2b3e61d9a38f32775d14b5ba1e825a9cf47e8157a7a20532a8df49ed2a121b803a4c8b24

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
bec2c348aae4e370a119304b7089fab5

SHA1
cf4286052402d47d67fa63b22d523427b90fe7fd

SHA256
323889556cff285b78a3e55c7df3d03e4d5fab4c41bcc4f9a2d96e9a62b155ef

SHA512
395829fe62536674f16ba76e3030cfec449aada4d081d7b2cd0697876a8db2474b05bf697cdd49eff250dedc34d9dde4a69daa8c76be6a3f5754f024cfa3342a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
cf26386ce9fc8b90cfff4d9380a8e527

SHA1
71d4c6f5acc0e35dad26dbc0ee8c265e36acf254

SHA256
8d18e110498599912b227282f70656f608755303b8acbaedfc1ed66ca94a3a57

SHA512
4fcef6795d625f07a79e1c344e9430d762981bd0b518ec49a2016a8806243e8f5f84aec6bcba1ccab494f8e39afe8a38d6e39463741649c354f649d461260aa7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
a49a8994e1d3c8440b1ac9edd6cd2b3a

SHA1
0db4ef18a268b4e6714f22dab1d935422e1ad718

SHA256
1cd8827d0fa815c7c3e74a4267edb94b7e2080831c48356395aacbc703aef5bd

SHA512
684275aa2e5ea9dd3e968cf3756efb4e6a3f851b84e5c54e3bbae7e7ddba213850e98b4e14e17b57dd1c9a8ce7d9ffc1672704b564c2bf81cc0ad155c533f8d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
0fbc61632974f6f29b389af69737faeb

SHA1
c6548ce17d48b0301938e3607ccc5ddeb6a29afe

SHA256
ea2e659f94962c0f2a1979d97f40f21a3bb69e16efd4f2e57fac9697f6e0be0f

SHA512
e09574ac51bf44175ef24143a16e80254561edf0b73f813bc8f453ee30ddb06c93e74ace3fdadc6b96f8a115bae4c2efc6cc3ba3bac79e7cf612799da6506770

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
3b807ee26c98b495a919961b5e212926

SHA1
de9def29b45a9194ce09c276f34fdc6dd2377fec

SHA256
dbfe9720eaf3ed06618c3825e235cd685a7e49e321d5ce41b76d32716024dfa6

SHA512
d188399a76b16402a569a94973cd94c6bce9592efcb0ce07178214fab03403b16bd2766e21e0a1aec2d6ce13ddaf35e58848bd9ca40605aeba9591d0900c90f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
49626189b170ef1f616fedbb8e9659fe

SHA1
6df320f02e0d792db7a9270bdf26e1116351bd2d

SHA256
86ad023b154bc56f0479808fdf3d462076c2f721ee896adf45439423ebabc435

SHA512
9c212d2220109b8375a366bf0bc1caa3446a26beab856c496b9699771d4786e5c51a3e1753942529d23545a16008e5e7ef8cf04451892691bc9dd2b9d85f6933

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
b62de344039504b0b7e9ecab12a1ddc6

SHA1
11699ed72e4a0fb9d5eed0bbbf1f7178f232ad67

SHA256
58061f377a32f4f7c17f754045f858ff470cfa4a709e98e67ef073e9de4c7864

SHA512
3f210258f81a22db9132027499bf655bbdb1c2b5d09552901f986a20b7586cf8a09d33d736db4b78a49f8ea2ea5b85ef2e7412d4e8a8ab01f213a1a98f56ae57

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
117e3c281379bb081f92c8e89bc80907

SHA1
be5812f2261db2102209720cc7828bd27fc7e4d4

SHA256
e7cec71c01d3b7c1d0746a0014a948bd1ce69c5329b5c1ef0b984360a82644b2

SHA512
4ae89f89af79dc59341d4a43956e61b45d7a3dfce1584bca6ac99968027689cdf45a13442cd826c06d09598cec43e674d13dd49c3a0100fa375f1acad5c0b2f6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
0810e56f14150a49f329fd814e44681a

SHA1
6274a45877ec782cf2d81c8682593a0318b98313

SHA256
43745e2610184e8a962f1618db51f58bbd82572a8fa01f67bdf520a579f1c079

SHA512
8b06819f3b3124c1a8c7205231eb4bb8628f98a42ef73698954afbc8b7e67cc5180352fe582b1c386cb2991d446e92835db1d6f55935ab8b1b4ddabede2e2121

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
cd84b119ebffaba74773617033cb6674

SHA1
7b0e335b8b678704566e0f216bc62b0e6655acc0

SHA256
466351c7e536669c4f42bd366ac43db91dc47e5b7f95af56507cb3294d0c1419

SHA512
fd9e7525c9b363d487edc5b14b9a68cb28ee5632cbb046726f15868d288bcc776d40e031c3af2fcbadee08cf83208160eeeda18caa1bd49f9fbedd6f30cf9af1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
4KB

MD5
ed4bf7a3d573a2f74174f4b6b2b3ce4e

SHA1
9eb14f7ffef1b9a1efdf67712758a579f7625a3a

SHA256
fce41934a2771525c68c524d90427f7e246ebe25bd407be2ca87b8eb28c81eab

SHA512
57b631db6887288d442eb529bc6c24b692c7d276b56c7952af3ab5e95f54765613e4dda03fd1297b2fb7d2bbd06bc837da76b4f1fa1115c3fdb43539b7bffef0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
9ee37bbd48ff7a1a68456b117b0a303b

SHA1
4561b070fadc2ba68d41f46560bd77ecd196b0a4

SHA256
80f4235cdf0ef650b6b58dbdacaec6e5720eb4679f28c274861660d08c9514f6

SHA512
1bc598aa04668826e93e4c2709fff37192105932c0e62b05fafe913986d675c7f1c12af2f45af4a8be41a74a95b393511e0e56173a6eb1388169f8409240bf18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
bc8c570bc0f2b3a7b840c068657fa6b6

SHA1
74e3b62dc1d8e7eb6e4403ce70e9eaab6af33355

SHA256
cd894ffde7a140b5d032a29ec43694a5d133448104cf79db87c866f7820d955d

SHA512
eeb5dce278690e4a57569b1a8fb3df126930b8106106c0915ef9627bf4f744a1024b56c7b7125df0e00e47dcb99ccad6f4d31713aa293869125ce3529e370b36

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
cb6ccab77622fa57c7fa8c99dd5c8cc5

SHA1
0631987814aeeb4b88974ff10f0311cfe4f87ef6

SHA256
0c220ffa13badfd659c6747258b451f07ad9150304e731eea9bbe6d24739b0d8

SHA512
fa5e40d949235e1b3b2aace3e8c8c79dc6940b0c31aa2004bb352a463a6ed186bc876bc6e6ab0714403649b6235a6a47a2fb7afaec100c429b2eea6b2efcf3b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
b4ecddf369366bfe52e9cba8d0bedc99

SHA1
af4c5407dd2ed37b639e79a6154f567636036ee8

SHA256
78f0a199d86fee526a7135a1cc442c4955d683688b902d38328c1d6b53c1940f

SHA512
57cb8bf7d6a3660cb09b10bf2b790ae789d52d9f8aae08a38ae1d1d9e12ce20fbb8f1e4eaa8fcadac49c289d4ca545ddc89dc09210c48788059fcaf9a27fe5d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
d9881ea1ea38b56c4130d2a28e8b4337

SHA1
31e5db83ddb68d283684adeecd47bb84aadb1a2e

SHA256
b4ba4ba3f832a667ef50e211655396cd0c49f193956a58a8ab0c74e208c63ae1

SHA512
c98fa43c3f026c9fa7a4a52a2693eb7ccf09e355d5a81baef2aee8b0612dc92080f960f7bfa598d5d01933334641012dbada4ce6cd5f1684bdda25b1186b9d86

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx

Filesize
817B

MD5
b68eff3595c120f016ccd89df416f8eb

SHA1
eb735b03325d735ba0f6200543c3458b73547a23

SHA256
05127968f649098c105f24b04c04f8d67169f4de3f653f72ba5b722cbbfce090

SHA512
64ddb97022f4be63a994c1781fb3d98385f611c35ae05cf8013ac42d9381c703fdae48bf117eb44be8c3efd0fd0d88685c07b72c8457d173e78b3c26ea3525f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
e2a262b41c4a32497031cf5848d9a2c9

SHA1
7f6a242757bf718f4db296287e17471fd7cfe227

SHA256
784fa62464b85e13965d74e1f5216628a1b6fcb77aec811401bba6f88294a9d2

SHA512
d17aae2ffa0827de63ee12dece114a90738f53266a3f93e3d9d2cf95d1f23eba04e0067270e1588a71f2ac42def615815408bcbcf8d6de7bd7806c3f58894cab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
9e4eb001ebdb502833796b593dd475bd

SHA1
92b05f9a5887e349bbc478eb57f94234381c3417

SHA256
4e32479ccb6a9567cc9fdcd37e36ea723d7c616d4b1058fb4fecdc17e78bbc12

SHA512
af7ce86d4e393965585e9295a85dd48790eb373650e3c75895c9690329f5bbc469ad242493fddb6fc994ed800d890a80ef2346021b6015a518daaf5c7392c308

Download Submit
C:\autorun.inf

Filesize
91B

MD5
1ecbee74203c68e028f33401bf4bbe36

SHA1
d61cb792dbf96b5a9b4d72367cb1150ca2618279

SHA256
05b04e8a590868f3fb7386de34a72288b90531d5d067bdc40f954a2736706293

SHA512
35620ad6fe8c69154311d71bd2459aa0048d8b98e24b4c5bcd8bc73780ac2b45cf7eb2e8adc0b8dfaeec2f54c0141ebe93a00bfb999ab17ee7d24948a6082960

Download Submit
C:\vcredist2010_x86.log.html

Filesize
82KB

MD5
6c07e9e2d6621105cfb1458cda118951

SHA1
ad36e673ac77d211a2743ac498132d8381cbaaa3

SHA256
05fa0c6167fd9c207da904277665c7f87353629afa7df1495b6c10fdfbc8e8fd

SHA512
a131a066b63205863e692207581c9ef363322c6ea066570e27c7d0ed06b1ead84f172ac9e82899ea7df5cbb86f85044749d8d471426b5256989db024c53db0ad

Download Submit
F:\Xiaohao.exe

Filesize
11KB

MD5
fbcff06b38e4ac7bcb904bdad1f9bdb9

SHA1
b4844e4398344a035507bb085353d8cce62739cd

SHA256
f75b7535365c80c14523f074f5007fc6769e0453562d369362dff9c7e52874e5

SHA512
29399e1558e4cffc128b38ba87d39d82184a971c4ab4baefc5ce452d9e03ce8f8515e9b41dc1038df65c11bbaec08200da42dfdc631820a1ea945b2ec4959a1d

Download Submit
memory/3296-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3296-343-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3296-4822-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads