Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 04:35
Behavioral task
behavioral1
Sample
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
-
Size
19KB
-
MD5
45de19db96387888c544ed23e0d3c262
-
SHA1
c39e2895b395ece3f8f87bee94fe7f63da07ed5d
-
SHA256
859d6e97784d475df795ab771f80f77398c4defb259e646be189def63ccd348b
-
SHA512
77ecc018d4ab0e070aebb032ba43885935909f14efb9296901da4e79ab3161b42ea1c1d9bdf47ed3bf1502f36e99fca1b79b8c3d108dcb91b2a1c4dfce5babec
-
SSDEEP
384:6ebFNw4Pk1itKkpAjjI2YpdmvHuBsrQMkEHm1aH+fKSWq:60FmBkpKjPYpZPh1a6td
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\scmvolume.inf_amd64_6957cfb7d6fea5c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_be5d923b5e701b62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrast.inf_amd64_935f1046c28ea0dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_20ad4886826af1d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\scunknown.inf_amd64_90993a57907d9959\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_8666ee4da6ad6325\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_209486f1c39d4b46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_cb639d1f182bc449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_220e4fad6c84d016\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netclient.inf_amd64_b7f9bb71730aaf1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_46dd0342577f43cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_dd85a83bc442ed33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_hidclass.inf_amd64_b37df5bd0922aeef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_95e01117eb9c1bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\firstrun\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ko-KR\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bg-BG\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-core_31bf3856ad364e35_10.0.19041.1266_none_8d243c0b6d3df152\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..anifests-multimedia_31bf3856ad364e35_10.0.19041.746_none_41c9c37e24436d0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p...appxmain.resources_31bf3856ad364e35_10.0.19041.964_en-us_f337cf878e4da36d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tings-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_b5a0e621a96fcaac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_10.0.19041.153_none_15f950fa37f594d9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-v1_31bf3856ad364e35_10.0.19041.1202_none_4eb79644aba9ef70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_system.windows.forms_b77a5c561934e089_10.0.19041.1_none_f1d47663d48a8243\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ai-machinelearning_31bf3856ad364e35_10.0.19041.1_none_ba5d622ef928b19d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_ipmidrv.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_fdcf84135b1feaa2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tion-admx.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_074ebb56fe54ec10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfds_31bf3856ad364e35_10.0.19041.264_none_8dc4a53bb0bf2a91\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_c_smartcard.inf_31bf3856ad364e35_10.0.19041.1_none_e7f11872e1ab72f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..acementmanifests-ds_31bf3856ad364e35_10.0.19041.746_none_0538f2a34494964e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ceruntime.resources_31bf3856ad364e35_10.0.19041.1_es-es_93903ad24e2a8c2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-themecpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_d161a4dcb73e2b4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ca609107df22e016\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlanui.resources_31bf3856ad364e35_10.0.19041.1_en-us_dcec1ba181e3ee3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssys..ore-tasks.resources_31bf3856ad364e35_10.0.19041.1_es-es_b84345c437d303cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a091ca79cb234929\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..installer.resources_31bf3856ad364e35_10.0.19041.1_en-us_8647fe1045d36986\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fde.resources_31bf3856ad364e35_10.0.19041.1_de-de_9b87b35ea94bf86e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..providers.resources_31bf3856ad364e35_10.0.19041.1_it-it_9ebf605d2eae43c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..nfrastructure-ws232_31bf3856ad364e35_10.0.19041.546_none_d0b0f7c32d25503b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..opactivitymoderator_31bf3856ad364e35_10.0.19041.1052_none_7ec56a9d21671e02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5ac15c525bc650bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5ccaaad67089b77a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-repdrvfs-dll_31bf3856ad364e35_10.0.19041.1202_none_f301e6cae62176b6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmiv2-wmidcom-dll_31bf3856ad364e35_10.0.19041.546_none_19a2e685024aeb16\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\diagnostics\system\Printer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.19041.1_es-es_904d757e80f51725\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cdae144d828691fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-psmcoreserver_31bf3856ad364e35_10.0.19041.264_none_88b304b9e166133c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netxex64.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e00e6573d8284a4f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_tape.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_2fe3200cf1d92ba5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_10.0.19041.1_none_cd3356f3257be89f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfmjpegdec_31bf3856ad364e35_10.0.19041.1_none_d9a3af9727ada122\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_8ae51494049df379\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlangpclient.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c658feb5f06faa9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.1_none_e880d45b6e684cd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_6b184251474f0fac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..atform-input-ninput_31bf3856ad364e35_10.0.19041.546_none_a7082f0e44f97dff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..cognition.resources_31bf3856ad364e35_10.0.19041.1_it-it_c45c04cdd763fd5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..dataretrievalclient_31bf3856ad364e35_10.0.19041.153_none_a276f5a2021aca33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ntlanman_31bf3856ad364e35_10.0.19041.1_none_e602234881fda6ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_71d70fbd497cca66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechengine.resources_31bf3856ad364e35_10.0.19041.1_de-de_25d651c486b399bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winocr-tifffilter_31bf3856ad364e35_10.0.19041.746_none_111c42f94a71c06b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_sdflauncher.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_8b57fae90a427954\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computer-name-ui_31bf3856ad364e35_10.0.19041.610_none_f66f88cf81a04c1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..pport-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_230a6b77590625d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmviddsp_31bf3856ad364e35_10.0.19041.1110_none_1bb01e5c2a6b0769\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-_vc_assembly_linker_dll_b03f5f7f11d50a3a_10.0.19041.1_none_f9e48e0b7c90652f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..-adapters.resources_31bf3856ad364e35_10.0.19041.423_en-us_728d6140a43d2b12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_net7400-x64-n650.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_4ecfe51516876b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-webhightrust_config_default_b03f5f7f11d50a3a_10.0.19041.1_none_eabf1c9ce6a17ae0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1023_ro-ro_bd79f664f129212b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000045a_31bf3856ad364e35_10.0.19041.1_none_b27c1886f5e6997a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_58c5c7f8f8f1b8ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netwmbclass.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_934c79d1174499c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.19041.1_de-de_f929398a7e8a1674\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe -
Modifies registry class 10 IoCs
Processes:
45de19db96387888c544ed23e0d3c262_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill\ = "EALOKZJCITOVLQN" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\ = "CRYPTED!" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe,0" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" 45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45de19db96387888c544ed23e0d3c262_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD59e42f042703a1218d6c240e86a10bce7
SHA1d93dfb855aa63b2fa1b925823bfd0916516bf0ff
SHA25645bd101248b2229f07b513f133793e875bb4c66b578e674300cc7ddced1ddfb3
SHA5120d0b0de68e23e9e3b34c74d2f32126cfff94c4b205a06522389953af0f9cff8f434f3623d4823ee78d07b6d60d0b6fe451918e715fce9fc81965ba42f0b3771d