Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-10-2024 04:35
Behavioral task
behavioral1
Sample
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
-
Size
19KB
-
MD5
45de19db96387888c544ed23e0d3c262
-
SHA1
c39e2895b395ece3f8f87bee94fe7f63da07ed5d
-
SHA256
859d6e97784d475df795ab771f80f77398c4defb259e646be189def63ccd348b
-
SHA512
77ecc018d4ab0e070aebb032ba43885935909f14efb9296901da4e79ab3161b42ea1c1d9bdf47ed3bf1502f36e99fca1b79b8c3d108dcb91b2a1c4dfce5babec
-
SSDEEP
384:6ebFNw4Pk1itKkpAjjI2YpdmvHuBsrQMkEHm1aH+fKSWq:60FmBkpKjPYpZPh1a6td
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\SQM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_neutral_27c5b45728cc9ed0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd2.inf_amd64_neutral_9dcd97ab7a913b7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnne30a.inf_amd64_ja-jp_b2245ba886355a9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wstorflt.inf_amd64_neutral_3db956c41708f7f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msdsm.inf_amd64_neutral_be2b348981b2ef17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky303.inf_amd64_ja-jp_b054bb0d59e0a3ad\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj5.inf_amd64_neutral_15940559c66fe8d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\blbdrive.inf_amd64_neutral_1aa816fe7dc98c3f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_neutral_46f893a4f998bb46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsmart.inf_amd64_neutral_829e8c7d1c8d5207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_neutral_c239ab5d36a3b3e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_neutral_7617862a9cc286da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_neutral_e9784021af1f5e24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netb57va.inf_amd64_neutral_6264e97d4fc12211\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_neutral_d0615d6fd67bad03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzoom.inf_amd64_neutral_dd07287cee791f3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_neutral_4c78da9e48068043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-msmq-messagingcoreservice\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\More Games\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\gui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Minesweeper\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VGX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Mahjong\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Solitaire\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ado\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-w..pdate-adm.resources_31bf3856ad364e35_7.5.7601.17514_es-es_ce2b0ea2df9c7897\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnep00d.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f46cdd8e6841ace5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.directoryser..anagement.resources_b77a5c561934e089_6.1.7600.16385_it-it_3b8b80c97a58ed2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_f55dd110912e81b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-u..-core-tsp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6e36394e6b402742\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_umbus.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bd6f884320ef84c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..-localspl-licensing_31bf3856ad364e35_6.1.7600.16385_none_6fa3721d0492b83d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wpdmtp.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4088ca2e421bafd7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\msil_presentationbuildtasks.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9f12f597c556b9b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_38997ae7317831f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_07f91de77125e78d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..up-notify.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1c3ac8797585f9e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9c5d09d99b94e200\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_networking-mpssvc-netsh.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_88ea3484666df7a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_es-es_847b31e13926c41b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_f2403b0511701c93\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.17514_none_ca4f304d289b7800\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-wmpsrcwp_31bf3856ad364e35_6.1.7601.17514_none_128e8361a0855574\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-netplwiz_31bf3856ad364e35_6.1.7601.17514_none_4d60c88813c7ed92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..platform-comruntime_31bf3856ad364e35_6.1.7600.16385_none_ca66ddfc9862f744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_6.1.7601.17514_none_703197983cc443e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ltimateed.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_34640473023e93d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windowsdx..xperience.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ea71b0ed2aff4b15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netvfx64.inf_31bf3856ad364e35_6.1.7600.16385_none_3b48242711d113f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..e_iassvcs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_93232ba9e6d74285\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dfs-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7240a8c0eb9a8132\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-au-component_31bf3856ad364e35_6.1.7601.17514_none_36a5754e72dd8aff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_windowssearchengine.resources_31bf3856ad364e35_7.0.7600.16385_de-de_6b6ac41c3ef125b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.xml.resources_b77a5c561934e089_6.1.7600.16385_de-de_1ef168b2be09072a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-findstr.resources_31bf3856ad364e35_6.1.7600.16385_it-it_08b4910de2e2f2fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ncsi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58dec972d8a9cb4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_6.1.7601.17514_it-it_332370b5404873ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-winrsplugins.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1083d44a32daf5e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_86596fc9e37f42ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..temclient.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2923fe40760e3420\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft.grouppoli..mpleditor.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8c7510e3977de711\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_718373162933d652\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-trkwks_31bf3856ad364e35_6.1.7600.16385_none_421749cb528eae99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6d0184ea2c28f513\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..roperties.resources_31bf3856ad364e35_6.1.7600.16385_it-it_27e2fb0e12b2297e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_nv_lh.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_762b7006168f3be6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-efs-rekeywiz.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1039ded3acd3a6fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_c118196b69901962\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..rojection.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9fab8e87796a99f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netb57va.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d5bb30b772a1933f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Iden1fe87377#\4c6cab2aa8b33a65a6b71a173f72767f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..an-plugin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f7b7ceae81f05fe7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..leshooter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6d916eeaa4077309\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_agp.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_18e1cd3e41cc4ae1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmgl006.inf_31bf3856ad364e35_6.1.7600.16385_none_cf6513cfad550965\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..nce-tools.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_1aa5cd22736b156c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_6.1.7601.17514_none_c8049b9e4ba7658c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_6.1.7601.17514_none_04514cd13d40a393\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..cy-engine.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5a0eb2396b2ceec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\fac6392e83ef7e777b78933e057c9546\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f00f5aeaea108c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-o..lfeatures.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_311994181e0c14c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f756da735a1be231\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\x86_regsvcs_b03f5f7f11d50a3a_6.1.7601.17514_none_be8bab32249b2a4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-stknote.resources_31bf3856ad364e35_6.1.7600.16385_it-it_479e75be2f9d7cb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Modifies registry class 10 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill\ = "EALOKZJCITOVLQN" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\ = "CRYPTED!" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe,0" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD59e42f042703a1218d6c240e86a10bce7
SHA1d93dfb855aa63b2fa1b925823bfd0916516bf0ff
SHA25645bd101248b2229f07b513f133793e875bb4c66b578e674300cc7ddced1ddfb3
SHA5120d0b0de68e23e9e3b34c74d2f32126cfff94c4b205a06522389953af0f9cff8f434f3623d4823ee78d07b6d60d0b6fe451918e715fce9fc81965ba42f0b3771d