Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-09-2024 19:04
Behavioral task
behavioral1
Sample
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
-
Size
12KB
-
MD5
02d8757eea9192313f9d5888a5bc1bc1
-
SHA1
a34044e9316c5d691cd73dd699210b3f10832fe0
-
SHA256
fc3bc3a24aaf95cb44ab5e9b8f8b9da0bdcbab344047696efabc15cf666cb03d
-
SHA512
d75b96a71f361180c03560d03771e341239f745b796830afc21bdde498994f75f1ddf3d206b00e43f1733e8edd7b97e8e0dfea2d119d0cc5528608972cad9eda
-
SSDEEP
192:y/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM0ICU:yebFNw4Pk1itKkpAjjI2Ypdm0nU
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_neutral_d0615d6fd67bad03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Msdtc\Trace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\averhbh826_noaverir_x64.inf_amd64_neutral_2fe3b14136d6e46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaky002.inf_amd64_neutral_b898f5982403f3cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_neutral_207a02df8e9e6552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\faxcn002.inf_amd64_neutral_3d392ccc357e04db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netbvbda.inf_amd64_neutral_2bfa4ea57bd5d74a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc1.inf_amd64_neutral_662220c3016bb4d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\spp\tokens\ppdlic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_neutral_c86d6d5c3810fc04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00d.inf_amd64_neutral_2c3623fa97b0c28e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_neutral_e204d4267d752eb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\averfx2hbh826d_noaverir_x64.inf_amd64_neutral_da2ba9e8a30dad14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbr008.inf_amd64_neutral_2cedaac353c381da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle002.inf_amd64_neutral_c7564163ba063094\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_neutral_22118b1072f57433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_neutral_11abcf129a29fb9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_neutral_1cb648411f252d13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\jfr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Mahjong\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Mail\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\skins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\browser\features\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\WSS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Journal\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\ehome\wow\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-commonlogservicesapi_31bf3856ad364e35_6.1.7600.16385_none_caaa1808998835c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.1.7600.16385_none_87a28b30f517e40e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ifffilter-licensing_31bf3856ad364e35_6.1.7600.16385_none_7c918ba35c1353e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-sysglobl_b03f5f7f11d50a3a_6.1.7600.16385_none_2dd34bce31fcb3d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-extrac32.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97d51f601c9c22d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-speech.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bffd088a98b14b9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20423_31bf3856ad364e35_6.1.7600.16385_none_ae5b1276ffc4917e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..overy-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6c0914f116e9cb10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ds-ce-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6a0dd7ce3b0d1786\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_ntprint.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bb3be3313c533620\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..tcard-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a1ca29daacde8bf2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wsdapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a5fefa8c3c618a5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-font-truetype-phagspa_31bf3856ad364e35_6.1.7600.16385_none_cec462f31334afc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-domain.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bcb16050d60db993\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..endedjoin.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_97c18dc251926a0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c94ff0f7345728e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netbc664.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3504beafa788c5aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-mscorld_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_4f8e3902f1d60540\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Serialization\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-950_31bf3856ad364e35_6.1.7600.16385_none_ceb3c2f6fc8d51d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmbr00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8b8f135fb4d48ad6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..ilter-rtf.resources_31bf3856ad364e35_7.0.7600.16385_it-it_7038056b3638d2d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-installutillib_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_43907f7b80523a4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20290_31bf3856ad364e35_6.1.7600.16385_none_5577c689454fb8e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_netfx-mscorsvc__dll_b03f5f7f11d50a3a_6.1.7601.17514_none_2f4c7f14c0acdcc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_networking-mpssvc-admin_31bf3856ad364e35_6.1.7601.17514_none_a75997dee0110f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-forfiles.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d8507d084bab834b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-nlsbuild.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5f2ec58e71d68339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_6.1.7600.16385_none_4fe1621f29206ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_6.1.7601.17514_en-us_b7cfcc08ef7b2e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_uk-ua_3a78caff71c4e322\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ieframe_31bf3856ad364e35_11.2.9600.16428_none_514e29fff78dfcea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-tables-1cb0_31bf3856ad364e35_6.1.7600.16385_none_c4662e307e0c342e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00001009_31bf3856ad364e35_6.1.7600.16385_none_510928a0b00d5cf9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d8bd62636b304029\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..r-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61bd0bffc3b33c9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\inf\usbhub\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_ddores.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5ae3b6557d8dfb17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-mail.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9de2dfa6eb493ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..-component-issuance_31bf3856ad364e35_6.1.7600.16385_none_9dbd9c6261eb657b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-whhelper.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9e36f97a9f4585d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..monitor-driverclass_31bf3856ad364e35_6.1.7600.16385_none_b5d60f222b50ead3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..o4-codecs.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8a8040648222662c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehrecvr_31bf3856ad364e35_6.1.7601.17514_none_1b8f8373383de46a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_nettun.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddebcf254b5b6198\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\msil_presentationui_31bf3856ad364e35_6.1.7600.16385_none_ab80eb1b9ddb88ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-a..nce-tools.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_24fa7774a7cbd767\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_2bf2f100dfb34cb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Printing.resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..re-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_62acc7da36290ffb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..in-gpedit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8ff3b684e14f2121\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ic-module.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1111490cda1f48da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fb8cbdeda98b1fcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rgraphing.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ff84ba08a32b21e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2756307705e84ff1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wiaxx002.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_586bb999e79bb340\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..pulations.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b6d6b255e38b4c57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mydocs.resources_31bf3856ad364e35_6.1.7600.16385_es-es_98b94fd06b7ed874\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..n-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8d540a2e3e43f231\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_ko-kr_56dbe7af675ee369\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_34c793a021d7370d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\ = "CRYPTED!" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KDWGUABUGOUDFYP" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe,0" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295B
MD5481efe329c3e9a73708ad487b301a620
SHA144572ce4a8b427d5cec59667be23eb43cd379196
SHA256eac9b59ef3964a8de6d4f90c20c44575c4e691eddd391e8c0a579f53a17f8ac1
SHA512c37cf59c46b9990851e7ec4a3becfab649250416027e1929fee731a244770d66b3df93b447ff08cd1518164b9215d493960030e427d771c13920e731f63ea092