Analysis
-
max time kernel
94s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 05:32
Behavioral task
behavioral1
Sample
33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
-
Size
7KB
-
MD5
33755784b9128aabea98a2d4f0bebb86
-
SHA1
4e327c4deae1ca7199408dd3e33ee7feb692b6b0
-
SHA256
05d0be6bbf2ce6d8b29a257629e071836290cf2a83e16641cf08ba5378317f9a
-
SHA512
1eecab22c39d01d57026136a398dc3f8369c0830821de6aa95b60ade277f91079f5fc0bcd2f589f8c2e362a4803108ea388d1e5ab190a359d0ae1caf1273bd4b
-
SSDEEP
192:gzdrr1FG1WDCgmjPZpO3GQ3aVAzMeisDUA:gprr1gkDCgSBQ39zMvsDB
Malware Config
Signatures
-
Detected Xorist Ransomware 6 IoCs
resource yara_rule behavioral2/memory/4748-5414-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4748-5415-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4748-6959-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4748-6960-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4748-6961-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4748-6962-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InstallShield\setupdir\0014\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_78faaf2062860ce8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_a99a7ecb03853141\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_sbp2.inf_amd64_db7034ac4806cf05\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\percsas3i.inf_amd64_c17a63dada1eaa02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\scmbus.inf_amd64_c78fd781987c1675\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsundelete.inf_amd64_741f159cc6ce7814\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_dd85a83bc442ed33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_db80a6e1be3a2d08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidi2c.inf_amd64_aad0f43cb9f97e75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_keyboard.inf_amd64_56ea9763e933f7c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_f52d5ad58116f6f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_7a75739c411a71d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp.inf_amd64_614ec8e6e63777b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_f02375bf47a4adb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bthoob.inf_amd64_c6923052f60677d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_avrcptransport.inf_amd64_6506aa4ac05430d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_42b97498c7087292\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4748-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-5414-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-5415-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-6959-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-6960-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-6961-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4748-6962-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\FileAssociation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lo-LA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\HoloTileAssets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\msil_microsoft.powershel..sreadline.resources_31bf3856ad364e35_10.0.19041.1_en-us_750932d6044aa044\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_de-de_e6ca3ecba1d5d7da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-psmcoreserver_31bf3856ad364e35_10.0.19041.264_none_88b304b9e166133c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..mework-msctfmonitor_31bf3856ad364e35_10.0.19041.1_none_3b2d243ce816c794\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wincal-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6e19685b50661c80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfcore_31bf3856ad364e35_10.0.19041.1288_none_6ff4f71140c21686\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\rescache\_merged\3479232320\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..brokeredapi-onecore_31bf3856ad364e35_10.0.19041.1023_none_857afe8b048a21c9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_it-it_6faeee6765322d55\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..krecognition-forime_31bf3856ad364e35_10.0.19041.1_none_f9d8ab7690adee48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-flacencoder_31bf3856ad364e35_10.0.19041.746_none_fcdcc022ec231bfa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..-wow64-setupdll001a_31bf3856ad364e35_10.0.19041.1_none_a29479c550cbf9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mf-vfw_31bf3856ad364e35_10.0.19041.1_none_98d28d5b3a9a4d43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\SMDiagnostics.Resources\3.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..izationv2.resources_31bf3856ad364e35_10.0.19041.1_es-es_7edc91791b96d497\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-service.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6f03369bdbe6f7e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windows-id-connecte..nt-provider-msidcrl_31bf3856ad364e35_10.0.19041.1_none_bd88d8f644ba1b11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-dll_31bf3856ad364e35_10.0.19041.546_none_60324d60a5ae9b6f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\diagnostics\system\Apps\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hal_31bf3856ad364e35_10.0.19041.1151_none_1ff907b40ed3d811\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..forcesync.resources_31bf3856ad364e35_10.0.19041.1_en-us_35c80a26e09be706\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_zh-cn_d64794aa85c0c266\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a54e43e89061b9df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unimodem-config_31bf3856ad364e35_10.0.19041.746_none_d2faec5a7d7a017e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000042b_31bf3856ad364e35_10.0.19041.1_none_b2ede40cf59d511e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_10.0.19041.1_none_92265dee13580837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shimgvw.resources_31bf3856ad364e35_10.0.19041.1_en-us_6bc761c3a854b663\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_68d5e035b6ec23ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobilepc-sensors-cpl_31bf3856ad364e35_10.0.19041.1_none_b8404bc3ae43ebc4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.19041.867_none_f01b2255d690daa4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..nefiles-extend-apis_31bf3856ad364e35_10.0.19041.746_none_7540b255c77bbc31\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-tasks_31bf3856ad364e35_10.0.19041.1288_none_c098111d522e08c1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webdavredir-davclient_31bf3856ad364e35_10.0.19041.1_none_49be76c2f19cc0ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-onecoreuap-deviceaccess_31bf3856ad364e35_10.0.19041.264_none_d64e0686f90d801d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_it-it_5f12ca8cb7d24b25\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4dfbfb89c0d31483\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-peertopeerpnrpautoreg_31bf3856ad364e35_10.0.19041.1_none_98d1b13fbddfe3bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netelx.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_196b5dadc5c810b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_pt-br_eef506143c1bff6a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-mscorrc_res_dll_b03f5f7f11d50a3a_10.0.19041.1_none_6962918018cd654a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..opeerpnrp.resources_31bf3856ad364e35_10.0.19041.1_it-it_e7ebc91c3e26cebb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ru-ru_f212f1ebceb5ba45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..licensing.resources_31bf3856ad364e35_10.0.19041.1_en-us_08d1b5059efefa1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation-mfsvr_31bf3856ad364e35_10.0.19041.153_none_a6fd395b4e3ef24e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-propsys_31bf3856ad364e35_7.0.19041.1023_none_aef517a235fd01bd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sud_31bf3856ad364e35_10.0.19041.746_none_8ff3e9e0ef1a312e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..ofile-cim.resources_31bf3856ad364e35_10.0.19041.1_de-de_16856c7806b33c71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-wmi.resources_31bf3856ad364e35_10.0.19041.1_en-us_c6408d2a877d3352\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_21c1d4d9a4333033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..pc-mathinputcontrol_31bf3856ad364e35_10.0.19041.746_none_6056b3bf0aef1a0c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_mmcfxcommon.resources_31bf3856ad364e35_10.0.19041.1_es-es_acb3246d5222b843\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.19041.1_cs-cz_76c6f18fc1f5c1eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_5a27dc45332041e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netathr10x.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7686c9325a2b562a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ef5ec4daaf3f5b8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MQISXQQKMIDJKVK" 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\ = "CRYPTED!" 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe,0" 33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33755784b9128aabea98a2d4f0bebb86_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290B
MD545f35ddbedac15a2a3a7849543dd9f65
SHA182f11f58c6ec43a262383fcb91347c5dc48d50dc
SHA256d3180592af35bcf9c70c24e6f1b11784c4a209167e38261b27f01a9ad36db5c6
SHA512c574be496143d89d41704fa3334a095a46d2270df68ca6213262ed66313fa620895f60461f156412be0c225da7e17b9d0fd4d34255c90bfc2441264da89d6612