xorist | 05d0be6bbf2ce6d8b29a257629e071836290cf2a83e16641cf08ba5378317f9a

General

Target

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Size

7KB
MD5

33755784b9128aabea98a2d4f0bebb86
SHA1

4e327c4deae1ca7199408dd3e33ee7feb692b6b0
SHA256

05d0be6bbf2ce6d8b29a257629e071836290cf2a83e16641cf08ba5378317f9a
SHA512

1eecab22c39d01d57026136a398dc3f8369c0830821de6aa95b60ade277f91079f5fc0bcd2f589f8c2e362a4803108ea388d1e5ab190a359d0ae1caf1273bd4b
SSDEEP

192:gzdrr1FG1WDCgmjPZpO3GQ3aVAzMeisDUA:gprr1gkDCgSBQ39zMvsDB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2116-1830-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-1831-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-3314-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4586-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4763-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4764-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4765-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4766-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4767-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4768-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2116-4769-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Drops file in Drivers directory 7 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

Drops startup file 1 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe"	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_neutral_7572473d88d69307\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Msdtc\Trace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_neutral_fe42c0ff14d5562b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_neutral_7c21481229e1e66c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\imekr8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_neutral_e68956e24e287714\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wdi\perftrack\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_neutral_4c78da9e48068043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\imekr8\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0804\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_neutral_e5ca2f01ca47bddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_neutral_8e3809aa77440c37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_neutral_14cb440c800fe9fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_neutral_c2bb3ef1c45cd5a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-ADFS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-audio-mmecore-other\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2116-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-1830-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-1831-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-3314-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4586-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4763-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4764-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4765-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4766-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4767-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4768-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2116-4769-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\More Games\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\b023321bc53c20c10ccbbd8f78c82c82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Wind5abb17e9#\5e166029e28675fbb6e2fc59ac6fa167\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-diskmgt.resources_31bf3856ad364e35_6.1.7600.16385_en-us_844346d4b571e6c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..cywmdmapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0644e7edbaa4b31c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9b0c6b4d7ef992f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..-service-mmc-snapin_31bf3856ad364e35_6.1.7600.16385_none_76a3e7136851eccf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..favorites.resources_31bf3856ad364e35_8.0.7600.16385_de-de_5ebba2a00671142d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wdmaudio.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_89b3674078c70745\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d8f2057f6b094e84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ldap-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0a1287b745a0addd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\inf\rdyboost\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-library.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_594fd86cb2695abd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-touch.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7f671ca38f25e7ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mail-app.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e0e3f8ce188d8546\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_de8f9631acce7e4f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\Resources\Themes\Aero\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..r-library.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6302540265a9aa44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_7.1.7601.16492_fr-fr_c94919266ff3de42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prngt002.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e2864945796e9e75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_918b43ae67cf6a1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationProvider.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.22cc68a8#\d6af9b93ec347c84ed702eb0e824f218\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..ienttools.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4d5cdc7ece584a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.17514_none_c1f959bd9451d7a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..idgenetsh.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af7c45fb3af0e8ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_smartcrd.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_55546733ef5647df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.vsa.vb.codedomprocessor_b03f5f7f11d50a3a_6.1.7600.16385_none_19034b5baee4e923\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eb5ec32f73606acf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-28592_31bf3856ad364e35_6.1.7600.16385_none_5569e4a945590861\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..converter.resources_31bf3856ad364e35_8.0.7600.16385_de-de_bcae5270428aeb14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_a370be9aa0513adf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_ko-kr_90aaf546884659bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_8.0.7600.16385_de-de_f143e898c6a82cb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_net1qx64.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9741bc4d255f06bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..rdefaults.resources_31bf3856ad364e35_6.1.7600.16385_de-de_080a9b1ecddb2b6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-acproxy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d3779478057f3fce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_6.1.7600.16385_de-de_040354651b707cc9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b5f86a77f3ebc892\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration.resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..ional-codepage-1141_31bf3856ad364e35_6.1.7600.16385_none_7d9e4fef2446d24e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sstext3d.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e52dc464fc8f40ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mystify.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7c8fa5a9054c2f41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_30c0365027dd4aaa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-s..iveengine.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4fd161061134e728\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..rity-ntlm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0a6e2760c0b4b30d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..oledb-rll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3391b84138f461f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tcpip-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_32c83d2a27a41a20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..s-service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_676207815c08e334\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_vsmraid.inf_31bf3856ad364e35_6.1.7600.16385_none_505ceec7b425f388\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.web.dynamicdata.design.resources_31bf3856ad364e35_6.1.7600.16385_de-de_90d056b07c64c2b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..lorer-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4c1260d68834de6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-ntevent-provider_31bf3856ad364e35_6.1.7601.17514_none_4e7fa5bfc379eecd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..ibinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_81816f6d8ca15354\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netl160a.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7bf16b713774351e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sud.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f804fc3ab9b02239\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..ecore-acm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b56f3a1a1dd48572\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gameexplorer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6a65a32788e2b710\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\Help\Help\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-858_31bf3856ad364e35_6.1.7600.16385_none_2adc7826b4e37422\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..lfeatures.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1b418a5ef53dfa44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ac-sql-cliconfg-dll_31bf3856ad364e35_6.1.7600.16385_none_6a55ae27bba9eda7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_234809c32cf5e8cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmbtmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_af17a416dc74fd47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

Modifies registry class 10 IoCs

Processes:

33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe"	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MQISXQQKMIDJKVK"	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\ = "CRYPTED!"	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe,0"	33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
290B

MD5
45f35ddbedac15a2a3a7849543dd9f65

SHA1
82f11f58c6ec43a262383fcb91347c5dc48d50dc

SHA256
d3180592af35bcf9c70c24e6f1b11784c4a209167e38261b27f01a9ad36db5c6

SHA512
c574be496143d89d41704fa3334a095a46d2270df68ca6213262ed66313fa620895f60461f156412be0c225da7e17b9d0fd4d34255c90bfc2441264da89d6612

Download Submit
memory/2116-4763-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-1830-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-1831-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-3314-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4586-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4764-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4765-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4766-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4767-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4768-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-4769-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads