xorist | f94e046ff324287451647b5254e5f0ca9c59b9ba83a8894f36b2f1f1cfceac89

General

Target

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Size

7KB
MD5

1777c7da017bf4cc36774c5c6cd66131
SHA1

7c48026732553ee98f49856ed9e3555bc7a68fe9
SHA256

f94e046ff324287451647b5254e5f0ca9c59b9ba83a8894f36b2f1f1cfceac89
SHA512

56bc458edbc800f4373408208d5d73035d0ca9d94ff1ee94908cfc364f98552a568ba68eb9aa04376cfdff2a804f1a9d7f3577adeab1300fa5c43d3b041f82f8
SSDEEP

192:1zdrr1FG1WDCgmjPZT8ukd7f7lK8gjMUA:1prr1gkDCgS1SnlK8QMB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4760-5554-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4760-5551-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4760-6920-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4760-6921-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4760-6922-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4760-6923-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Drops file in Drivers directory 8 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

Drops startup file 1 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe"	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\F12\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_186702cd081cddb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_holographic.inf_amd64_6ab9629b23deb837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stornvme.inf_amd64_1218fad01506b7af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp.inf_amd64_614ec8e6e63777b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_fe91941ed205cd9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smrvolume.inf_amd64_9a3d52a168ca8fee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcard.inf_amd64_bf5afc5892966e30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidi2c.inf_amd64_aad0f43cb9f97e75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsundelete.inf_amd64_741f159cc6ce7814\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_8666ee4da6ad6325\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_51d6c57c66e3de87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_proximity.inf_amd64_e42355875c34e406\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_heartbeat.inf_amd64_ad33c2d1c7a3023e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rhproxy.inf_amd64_7d28259fbc48ab7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lltdio.inf_amd64_4faf5a37ebdbec2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4760-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-5554-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-5551-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-6920-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-6921-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-6922-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4760-6923-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Services\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fa-IR\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\StartScreen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ntication.resources_31bf3856ad364e35_10.0.19041.867_en-us_81576777c631aa40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netimm.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9d84416a5ba64afe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dot3gpclient.resources_31bf3856ad364e35_10.0.19041.1_de-de_303b9df28f24098e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Printing.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmsynthstor.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6402e881a991e104\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-efsadu.resources_31bf3856ad364e35_10.0.19041.1_de-de_ce1c34934597018d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netevent.resources_31bf3856ad364e35_10.0.19041.1_es-es_3844e7b65b1bcfb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.19041.1202_none_57d72a0470694b5a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-uxinit_31bf3856ad364e35_10.0.19041.1266_none_dc706e75d5c4b6a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-eventlogmessages_dll_b03f5f7f11d50a3a_4.0.15805.0_none_f28ceb54954349f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.web.services.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_f463c3ae7245b3cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_fc71307a1bc28bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pnpibs_31bf3856ad364e35_10.0.19041.572_none_1fcf5277cadc6026\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..nts-mdac-rds-ce-rll_31bf3856ad364e35_10.0.19041.1_none_219f4d8115eeff5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoveryagent_31bf3856ad364e35_10.0.19041.964_none_a302f6630325804a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\enterpriseNgcEnrollment\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..age-codec.resources_31bf3856ad364e35_10.0.19041.1_en-us_6571530dce9cb6dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ormid-wmi.resources_31bf3856ad364e35_10.0.19041.1_de-de_ccf7bb08e4c41803\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-storport_31bf3856ad364e35_10.0.19041.1288_none_9c43f532e55ea1ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tapicore.resources_31bf3856ad364e35_10.0.19041.1_de-de_06e85abd0c87cad0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_pt-br_437f973c60443247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq.resources\v4.0_4.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_acpi.inf_31bf3856ad364e35_10.0.19041.964_none_3d9d158f5b388140\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..onfidence.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_3fa28029d783125a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dims.log_31bf3856ad364e35_10.0.19041.1_none_b65f6e0f7610d90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_10.0.19041.1202_none_a344a46595240538\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1816d16047bf2f26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-cfx_extended_sql_files_b03f5f7f11d50a3a_4.0.15805.0_none_be318b1e895e8b23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.EnterpriseServices.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..icepickerexperience_31bf3856ad364e35_10.0.19041.964_none_652e2f900e1c3d94\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-perfcounters_31bf3856ad364e35_10.0.19041.1266_none_bf97c5d5f86e2a8c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..em-core-classdriver_31bf3856ad364e35_10.0.19041.746_none_0dfdcdbd4d7b1f72\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_10.0.19041.746_none_ecd2f78c8a8b0229\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-vmbusvdev_31bf3856ad364e35_10.0.19041.928_none_ac1cf51d1258824d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cryptxml_31bf3856ad364e35_10.0.19041.1_none_04f27d56494ec1f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_2615db8581c0c131\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hdaudio.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_243adecd95a0cecd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ents-mdac-ado15-vbs_31bf3856ad364e35_10.0.19041.1_none_ca9092840a8b22c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-usermodepowerservice_31bf3856ad364e35_10.0.19041.1023_none_d2e23d980197bef4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_volsnap.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_c91f955d20c278ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dskquoui_31bf3856ad364e35_10.0.19041.1_none_3e7431a28813593d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..e-utility.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee73264552537014\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-com-legacyole-olecli32_31bf3856ad364e35_10.0.19041.1_none_c13b9bea1e9e7acc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-desktopdispbroker_31bf3856ad364e35_10.0.19041.84_none_f466a1720e031a89\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..ngservice.resources_31bf3856ad364e35_10.0.19041.1151_en-us_8bea4e0b86020402\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_684a86f0f0d0d27d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-vbscript_31bf3856ad364e35_11.0.19041.1266_none_0b2c951a40edb356\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_multipoint-wms.dashboardcommon.resources_31bf3856ad364e35_10.0.19041.1_de-de_93210604eb449d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_9b70177c85a8df54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_10.0.19041.1_de-de_115e3c7930ed0747\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-van_31bf3856ad364e35_10.0.19041.746_none_9467fa2aec3ba9e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3847f8182fe7f76e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wpdmtphw.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_41baab3d38e2ed45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.hyperv.po..l.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_it-it_a4bf58d26dd181a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.19041.1202_en-us_bcda61367fb1fc47\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.19041.1_none_420589df53dc49e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4a7d63472b217a24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

Modifies registry class 10 IoCs

Processes:

1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe"	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KDWGUABUGOUDFYP"	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\ = "CRYPTED!"	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crNDKg6E9FSWFuQ.exe,0"	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open\command	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\DefaultIcon	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KDWGUABUGOUDFYP\shell\open	1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1777c7da017bf4cc36774c5c6cd66131_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
295B

MD5
481efe329c3e9a73708ad487b301a620

SHA1
44572ce4a8b427d5cec59667be23eb43cd379196

SHA256
eac9b59ef3964a8de6d4f90c20c44575c4e691eddd391e8c0a579f53a17f8ac1

SHA512
c37cf59c46b9990851e7ec4a3becfab649250416027e1929fee731a244770d66b3df93b447ff08cd1518164b9215d493960030e427d771c13920e731f63ea092

Download Submit
memory/4760-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-5554-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-5551-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-6920-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-6921-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-6922-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4760-6923-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads