Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 17:34
Behavioral task
behavioral1
Sample
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
-
Size
7KB
-
MD5
0bcadfa6300173d952219bf4674ac140
-
SHA1
479a733f3fd375afbf607c132025faa336f5a33d
-
SHA256
a0f32da7313ba6c28cbb3635d841428fe467b99a4906f9b6f76d30bf36eaccb5
-
SHA512
9bcac81d76e9faf93417afd2e430c6c796e5c1a67605c0f2428cfeb706685b9bac1892dc682b5b1267eaf559a37d7bd16139b0937035a845cd50ff2f6cc82576
-
SSDEEP
96:WzFZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExaaLdTLIQi9VeMUA:GFzdrr1FG1WDCgmjPZaaRTlgVeMUA
Malware Config
Signatures
-
Detected Xorist Ransomware 6 IoCs
resource yara_rule behavioral2/memory/5004-5955-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/5004-5956-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/5004-6916-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/5004-6917-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/5004-6918-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/5004-6919-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\c_bluetooth.inf_amd64_7e49a68f06c14d10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_b401376fd0a39c95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\slmgr\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscfsmetadataserver.inf_amd64_ef3485e85c5c1b11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_919b7beec2c70482\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_bc507add47f436ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_modem.inf_amd64_8cddb75e34142905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas2i.inf_amd64_b4e933c4540ad3cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_9658f2eb83f061c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-MX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_e90a0a4c8e15815d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\arcsas.inf_amd64_b3d75f82c617ac6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_swdevice.inf_amd64_12050f4158021fcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_3bc71c4327f9f94e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_911a60fb265ff111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpipagr.inf_amd64_a3248d35e6aba0f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic_kvpexchange.inf_amd64_b3c17aa69dce1e0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_c20a3bb7ac1cd207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_cb639d1f182bc449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_3ae2ea3a55ec0279\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-5955-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-5956-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-6916-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-6917-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-6918-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/5004-6919-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{E9FAE721-C42D-4B32-B146-9DE88A456C64}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\uninstall\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\th-TH\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\osfFPA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Common Files\System\msadc\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sv-SE\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo.resources_31bf3856ad364e35_10.0.19041.1_de-de_715792e6d26d275a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..2provider.resources_31bf3856ad364e35_10.0.19041.1_de-de_a7be51e8be07716e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.19041.1_de-de_7db410cfb25a0a40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_10.0.19041.1_de-de_9d7f085c28400278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-data-pdf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8cadf5c8a1c695d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.19041.1288_none_1b12314c11faf44f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msports_31bf3856ad364e35_10.0.19041.1_none_430e27fc8ea24011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.dtc.powershell.scripts_31bf3856ad364e35_10.0.19041.1_none_b743504584ec3c06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.componentmodel.composition_b77a5c561934e089_4.0.15805.0_none_9f616d3454487e5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_usbxhci.inf_31bf3856ad364e35_10.0.19041.1266_none_b7aaeaf31645aa79\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_secur_res_b03f5f7f11d50a3a_10.0.19041.1_none_8461975bd0e54b32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..nese-eacommonapijpn_31bf3856ad364e35_10.0.19041.746_none_7a41a0536353d619\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.19041.1_none_4d79d2e8d54e26a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..extension.resources_31bf3856ad364e35_10.0.19041.1_it-it_2d7286fb5d9f709c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.19041.1_none_12fcd173608a3b6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dc21x4vm.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dd91effccdcc1b3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c8_31bf3856ad364e35_10.0.19041.173_none_e9ff08f651307ad7\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dssec.resources_31bf3856ad364e35_10.0.19041.1_en-us_8282f480c828525c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-aadtb_31bf3856ad364e35_10.0.19041.1202_none_501d0e950953d841\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..-system-diagnostics_31bf3856ad364e35_10.0.19041.746_none_067ab91a9944c3cd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-core.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_90524c006504f559\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_10.0.19041.1_it-it_706c44257f8b21a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..onsbroker.resources_31bf3856ad364e35_10.0.19041.1_en-us_cab0561e44eb8c66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..on-tokenbrokermodal_31bf3856ad364e35_10.0.19041.746_none_c24e59a965865013\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\servicing\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-mdmlocalmanagement_31bf3856ad364e35_10.0.19041.789_none_f45ee311420162d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..pport-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c58d3e5a4bff2dd7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-family-cache_31bf3856ad364e35_10.0.19041.1_none_cfb7afe27be05a0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechengine.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fd976ff432d7a4e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-status.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_60ebf27553e7dac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wpf-globalmonospacecf_31bf3856ad364e35_10.0.19041.1_none_39df3b5c4f7e9aef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..anagement.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_26178eff272aeb36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasbase-raspptp_31bf3856ad364e35_10.0.19041.488_none_77bf24d746c4ccde\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..baaupdate.resources_31bf3856ad364e35_10.0.19041.1_it-it_e5073b6f46b97c73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tion-wiatwaincompat_31bf3856ad364e35_10.0.19041.264_none_38c68dc04ed236b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.visualbas..lity.data.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_d717e99ad3eeaeb5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-configuration-data_31bf3856ad364e35_10.0.19041.1_none_b85d7ef5bf4cc5c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..njifinderdictionary_31bf3856ad364e35_10.0.19041.1_none_fc07cdcf552f3398\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dui70.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ba3b9e31f5de5c7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-d3dcompiler_31bf3856ad364e35_10.0.19041.868_none_c737c7c27aee1540\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..mogrifier.resources_31bf3856ad364e35_10.0.19041.1_en-us_45af741f190ea99f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c_proximity.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_04a4eb59dc5c6b67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip.resources_31bf3856ad364e35_10.0.19041.1_en-us_af599d7c79fd0790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_10.0.19041.1266_none_727d8ac8ed2b3e80\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.19041.1_de-de_09227eed3b9a79c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.web.administration-nonmsil_31bf3856ad364e35_10.0.19041.964_none_a652814defb84b57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.identitymodel.selectors.resources_b77a5c561934e089_4.0.15805.0_it-it_9f6408aab1bb1b79\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_cat_31bf3856ad364e35_10.0.19041.1_none_dc1e4bc5bb1bb738\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cfmifs_31bf3856ad364e35_10.0.19041.746_none_ce1a1fdab7d43d77\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..onverters.resources_31bf3856ad364e35_10.0.19041.1_en-us_9e3a329b943baa13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls.resources_31bf3856ad364e35_10.0.19041.1_en-us_abbd2db726d27f31\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.virtualiz..anagement.resources_31bf3856ad364e35_10.0.19041.1_de-de_0cb95964e4fe3928\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-fileexplorer_31bf3856ad364e35_10.0.19041.153_none_64dfae1afa14e771\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_multipoint-wmsusertab_31bf3856ad364e35_10.0.19041.1_none_1be305bb83cd1748\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\OfflineTabs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZEDXTPPUGUDHYFG" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe,0" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\ = "CRYPTED!" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" 0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0bcadfa6300173d952219bf4674ac140_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD50f8f1bcb3bc186c96cc2650fe18652cc
SHA1390735204b42718da68e76c38716d76ac5fc64af
SHA256b6f08bae98a0d74b6fc972b3a646c444aeda602b48bc67aa83f048784e76b6f8
SHA512f150a2ac8ee1cd7f9d23d7ca68adc4478824691363e86a4a37e60156ebfee7b629ec5d0df454a1ae16cc788bcd0f1eb2d056a8afa8f5b018164b1b8f2bebccfe