Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 17:34
Behavioral task
behavioral1
Sample
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
-
Size
7KB
-
MD5
0bcadfa6300173d952219bf4674ac140
-
SHA1
479a733f3fd375afbf607c132025faa336f5a33d
-
SHA256
a0f32da7313ba6c28cbb3635d841428fe467b99a4906f9b6f76d30bf36eaccb5
-
SHA512
9bcac81d76e9faf93417afd2e430c6c796e5c1a67605c0f2428cfeb706685b9bac1892dc682b5b1267eaf559a37d7bd16139b0937035a845cd50ff2f6cc82576
-
SSDEEP
96:WzFZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExaaLdTLIQi9VeMUA:GFzdrr1FG1WDCgmjPZaaRTlgVeMUA
Malware Config
Signatures
-
Detected Xorist Ransomware 3 IoCs
resource yara_rule behavioral1/memory/2188-4776-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/2188-4775-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral1/memory/2188-4778-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_neutral_e9784021af1f5e24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_neutral_c150a510c4b85ce7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvfx64.inf_amd64_neutral_194cb6d2ea3a486e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-OfflineFiles-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\adp94xx.inf_amd64_neutral_4928c8870f6a1577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\agp.inf_amd64_neutral_22cdceb61fbafb43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_neutral_be2f30f68f2a5567\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorcertdrv.inf_amd64_neutral_2e1cecffae9c899a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddm.inf_amd64_neutral_dd691eae66f3032d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx004.inf_amd64_neutral_0a3a62ae6ed43127\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\Web\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\slmgr\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_neutral_2ec26aaad7a9d419\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_neutral_7617862a9cc286da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_neutral_e567adb271831b5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\Microsoft-Windows-RasServer-MigPlugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\slmgr\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_neutral_4506dea11740c089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-audio-mmecore-other\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-AppServer-Licensing\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\angelu64.inf_amd64_neutral_3d6079dd78127f5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin004.inf_amd64_neutral_c8902ae660ab1360\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_neutral_4c228493af8567bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_neutral_735aa3b5ee832f62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2188-4776-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2188-4775-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2188-4778-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\DVD Maker\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows Mail\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7601.17514_none_3ba388ec36399c85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-863_31bf3856ad364e35_6.1.7600.16385_none_2addea58b4e20d54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-ipsecuritybinaries_31bf3856ad364e35_6.1.7600.16385_none_9c7b32377fa4af37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-userenv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1fb2926c3d49eba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wpdmtphw.inf_31bf3856ad364e35_6.1.7600.16385_none_54337c1f491bfb7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000418_31bf3856ad364e35_6.1.7600.16385_none_50a65bbeb04abb7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af8441663b8768a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-ehcmres.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad3418deaa35c167\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..edirector.resources_31bf3856ad364e35_6.1.7600.16385_es-es_29e3c66b028b48e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..an-plugin.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_17e482b9df1f3c64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-x..lugin-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e09467449b496f0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..ssettings.resources_31bf3856ad364e35_6.1.7600.16385_en-us_af75dfc28308d1c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..tconfigui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2af0d848ad52e8fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wininit-mof.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f2ed7f152a0658cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_01c6b44660ce74c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-themecpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1b46ed7c79343a41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..converter.resources_31bf3856ad364e35_8.0.7600.16385_en-us_659f28693168f6d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..vdsupport.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d179748dce1d26ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_pt-br_e25c94cbdcb98bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-common.resources_31bf3856ad364e35_6.1.7600.16385_it-it_324e7c801a8beef8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_4b49a2c2123fd42c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..tshow-asf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d83dd9134af59745\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-streambufferengine_31bf3856ad364e35_6.1.7601.17514_none_90b1bea0c80c2a3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_server-help-chm.reliab.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1eb6d304a88f909e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..libraries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5906a318fc470d1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2cd2a68aaaec5026\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasmm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_98f36a13cac0f221\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_msclmd.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cc73c19ece6bbb13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-migration_31bf3856ad364e35_6.1.7601.17514_none_e02729035a3379c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..vdsupport.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4655edb758a0a7f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-aero.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c50bbc6b30fb59e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_07f91de77125e78d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7ef5713984067904\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wiaca00i.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b8402b506633b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\msil_microsoft.backgroun..anagement.resources_31bf3856ad364e35_6.1.7600.16385_it-it_11985fe24a3d35aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_6.1.7601.17514_it-it_6e4620a36290fd66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c7dffd5bfc3b7f9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-mscorld_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_4f8e3902f1d60540\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..c-runtime.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f9aac1feaf3a90bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cabview.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_df86b162dfc2b286\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu_31bf3856ad364e35_6.1.7600.16385_none_a79a90daaf5bbeef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..madvanced.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3a0a9aa062f78c94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsBase\40864f42b00635e6fa6ce8da88d9ab83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ocker-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1b837c99d0daf6b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0f099c9be715da86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bits-perf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0786042ead1aa38b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-events-main_31bf3856ad364e35_6.1.7601.17514_none_590326050266f2c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rpc-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4496c1905a287a31\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.7601.17514_none_fbc0353d84c5d9cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_1898d1bbe9180b39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\inf\SMSvcHost 4.0.0.0\000A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-peerdist-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cf5fedd2532db929\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\msil_aspnet_regsql.resources_b03f5f7f11d50a3a_6.1.7600.16385_it-it_1f110f2815a4f22c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..snapindll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9e869704f8bf49cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-shacct_31bf3856ad364e35_6.1.7601.17514_none_c8099d957fb7652d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-network.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74e8789d956287b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..ackup-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e6151990d1af1ab1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-microsoft.jscript_b03f5f7f11d50a3a_6.1.7600.16385_none_f371f988e550616a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\ = "CRYPTED!" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe,0" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZEDXTPPUGUDHYFG" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD50f8f1bcb3bc186c96cc2650fe18652cc
SHA1390735204b42718da68e76c38716d76ac5fc64af
SHA256b6f08bae98a0d74b6fc972b3a646c444aeda602b48bc67aa83f048784e76b6f8
SHA512f150a2ac8ee1cd7f9d23d7ca68adc4478824691363e86a4a37e60156ebfee7b629ec5d0df454a1ae16cc788bcd0f1eb2d056a8afa8f5b018164b1b8f2bebccfe