Analysis
-
max time kernel
93s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 19:04
Behavioral task
behavioral1
Sample
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
-
Size
12KB
-
MD5
02d8757eea9192313f9d5888a5bc1bc1
-
SHA1
a34044e9316c5d691cd73dd699210b3f10832fe0
-
SHA256
fc3bc3a24aaf95cb44ab5e9b8f8b9da0bdcbab344047696efabc15cf666cb03d
-
SHA512
d75b96a71f361180c03560d03771e341239f745b796830afc21bdde498994f75f1ddf3d206b00e43f1733e8edd7b97e8e0dfea2d119d0cc5528608972cad9eda
-
SSDEEP
192:y/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM0ICU:yebFNw4Pk1itKkpAjjI2Ypdm0nU
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_4b833c2630a2a287\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0816\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\uiccspb.inf_amd64_18454ae612999870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_scmvolume.inf_amd64_de693592afe8a496\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_holographic.inf_amd64_6ab9629b23deb837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms013.inf_amd64_2b1aa5c0f193f278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmntt1.inf_amd64_263b3076d78209be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_28542b9aafacda15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ru-RU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_12d9f43eb5d02987\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\3ware.inf_amd64_408ceed6ec8ab6cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6a68abcc31aaa333\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\heat.inf_amd64_b73306c081719f1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_5a503c811e650e70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmgid.inf_amd64_3a0240393de08f95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\FileAssociation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\System\msadc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\ole db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\styles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\dotnet\swidtag\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-r..rascustom.resources_31bf3856ad364e35_10.0.19041.1_de-de_148bcd73db716b20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-netsh.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_497e3a0b7d47c831\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_10.0.19041.1_en-us_f3ef054dca7ac088\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-setup_31bf3856ad364e35_10.0.19041.1_none_4e115ed381b91727\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sfc_31bf3856ad364e35_10.0.19041.546_none_8f83b49eef61b1ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..umservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_221c1d52810a94c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_3ware.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_fb3f1f5e8a5b8121\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_bthleenum.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_3205ad037dd70a83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_hidbthle.inf_31bf3856ad364e35_10.0.19041.1_none_e133b39112405183\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_1584244fcf77f93a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b2e8334916e9fa7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eapttlsext_31bf3856ad364e35_10.0.19041.746_none_864699d659a20b3d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_systemresource-wind..tscontrol.resources_31bf3856ad364e35_10.0.19041.1_it-it_acb9570d6e946eca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine-structuredquery_31bf3856ad364e35_7.0.19041.264_none_e89f322d4b6b932c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-vmbusvdev.resources_31bf3856ad364e35_10.0.19041.1_de-de_046b817d274203bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_it-it_c4fc99c6204ed54e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.1_none_5ca728f7dabaeefb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nalservices-runtime_31bf3856ad364e35_10.0.19041.546_none_bad936652ad03072\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.19041.1_en-us_f897fcc23d070c97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationCore.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browsersettingsync_31bf3856ad364e35_10.0.19041.746_none_0edb2895e7aac812\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..olehostv1.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_609a816b39d84050\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-memoryanalyzer_31bf3856ad364e35_11.0.19041.1_none_acd9a07dfdc8db60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_th-th_640e7758936c63d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-l..volume-professional_31bf3856ad364e35_10.0.19041.1288_none_405c4314f359009b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c_fscopyprotection.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_932ee91eba631169\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tcpmondll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_03d365d5e6c58522\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_vmconnect6.2.resources_31bf3856ad364e35_10.0.19041.1_it-it_c742241b31b56d3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windows-media-speech-winrt_31bf3856ad364e35_10.0.19041.1023_none_92a7716633744928\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.transactions.bridge.dtc_b03f5f7f11d50a3a_10.0.19041.1_none_b00d61e723e803ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..-els-core.resources_31bf3856ad364e35_10.0.19041.1_es-es_b2ac2634369df78c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..g-printticket-win32_31bf3856ad364e35_10.0.19041.1_none_c94bb6333e8c7c9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_usbport.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d2ce1964037a8419\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..idmanager.resources_31bf3856ad364e35_10.0.19041.1_es-es_0c9794b84b969f93\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-attributionfile_b03f5f7f11d50a3a_4.0.15805.0_none_bdecefa7687adc22\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rdc_31bf3856ad364e35_10.0.19041.746_none_8f82e5b0ef625f9f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_prnms008.inf_31bf3856ad364e35_10.0.19041.1_none_99e09e463e404175\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-proxy-vmms_31bf3856ad364e35_10.0.19041.1_none_d7f7c81f5ce3ce59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-counters.resources_31bf3856ad364e35_10.0.19041.1_it-it_2d32e49793e74e5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ngconsole.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d4c701b137b37790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_hu-hu_0f39d18194c80f6e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networktopology_31bf3856ad364e35_10.0.19041.746_none_af4f4201594cb014\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wsp-health.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7f8e68757c0f0c07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..appraiser.resources_31bf3856ad364e35_10.0.19041.546_en-us_4df234ff3301d42e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..n-cmdline.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1b2fdfbe2871ee60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.transacti..ridge.dtc.resources_b03f5f7f11d50a3a_4.0.15805.0_de-de_5f012ec580190586\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-l..lperclass.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a08adbdf45420437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssharinghost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_75262c6a5f742355\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupcl-library_31bf3856ad364e35_10.0.19041.1202_none_3d14890c84f6bcec\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_10.0.19041.1_it-it_46f9db9be9f60091\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr.resources_31bf3856ad364e35_10.0.19041.1_it-it_0651e2fcbde94d45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..t-service.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f7b7ec57439918cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..framework.resources_31bf3856ad364e35_10.0.19041.117_en-us_25ec3fc11d07410d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-legacywmdmcesp_31bf3856ad364e35_10.0.19041.1_none_728ef3aca052b05c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapcontrol_31bf3856ad364e35_10.0.19041.1202_none_9269f331f42a1765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.Resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4250fafab5d5796a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tcard-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fbc645b7328b0bc6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbinding_31bf3856ad364e35_10.0.19041.546_none_5b191702c8e76e04\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userenvext.resources_31bf3856ad364e35_10.0.19041.1_es-es_963169ea1e6c1b20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vidproc_31bf3856ad364e35_10.0.19041.789_none_a739d930d582bc4f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\ = "CRYPTED!" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe,0" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KDWGUABUGOUDFYP" 02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02d8757eea9192313f9d5888a5bc1bc1_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295B
MD5481efe329c3e9a73708ad487b301a620
SHA144572ce4a8b427d5cec59667be23eb43cd379196
SHA256eac9b59ef3964a8de6d4f90c20c44575c4e691eddd391e8c0a579f53a17f8ac1
SHA512c37cf59c46b9990851e7ec4a3becfab649250416027e1929fee731a244770d66b3df93b447ff08cd1518164b9215d493960030e427d771c13920e731f63ea092