fc81a25f8fc4b2f0551babf0c85a88b839b3a13b10da7ae299be7122d0f14869

Analysis

max time kernel
101s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Size

732KB
MD5

579f0a2740ffc2304c75ebebe47c29a7
SHA1

424d6b1ac5ca3f45e794ed04e13280b3f32b8319
SHA256

fc81a25f8fc4b2f0551babf0c85a88b839b3a13b10da7ae299be7122d0f14869
SHA512

38777997a1a9f656bd422151a5e04817c8423a0be26490891adc462e1f05163e9204a6cfbe847312355ba1323ed78aad657b41af86fb4077dfc98f5246add64b
SSDEEP

3072:SNLJAjVd1nut+uV2mTVDjFwkWl176jZ1hCagdgvPW:SN6VdRQ/vqkg1gEagdgH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (739) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qAxMr02XPSFEbd2.exe"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_neutral_84eee4cc19fd00dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Quoting_Rules.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_trap.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_neutral_41c6262952846788\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_neutral_642a5ab3f2a1ae20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_data_sections.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Break.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_x64.inf_amd64_neutral_24a71cdaabc7f783\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_neutral_11abcf129a29fb9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky302.inf_amd64_ja-jp_dd74fe49601b74f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_prompts.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_requires.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_job_details.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_neutral_3b741ca76444b9c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1qx64.inf_amd64_neutral_85d10fa4c777b7be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_hash_tables.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_trap.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nl-NL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer-DRM-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Assignment_Operators.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_neutral_ce587aa61510da51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_neutral_330a593eb888237c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_neutral_5766736c47b90fff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_neutral_c81780c5dcabd0a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eehkmoacegabdgik.bmp"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Journal\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341636.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Install\{C3A4D3BC-D67A-4D2A-B0ED-B4E62D27E02C}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099186.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341344.JPG	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-photosamples.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e250f977be883edb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmeric.inf_31bf3856ad364e35_6.1.7600.16385_none_4c0e5acbb09d2ea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cttune.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bf229502a53866eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_it-it_227e33fb04382aa3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..drecorder.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e71817e2b05418d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..centercpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_495fbbff3df6bcb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..truetype-lucidasans_31bf3856ad364e35_6.1.7600.16385_none_d0e8774fa1155a53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sechost.resources_31bf3856ad364e35_6.1.7600.16385_es-es_38e2b06e48fa6c92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_script_blocks.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e1aaadd0fafd6f34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-0003041e_31bf3856ad364e35_6.1.7600.16385_none_43a1409d46c91ce9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUserXp\a6dc826bf08c95bd5fe459a02bbfd33c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Switch.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_History.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_63ab444ac6e5a279\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_filter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_a9d77998142ec36c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmtron.inf_31bf3856ad364e35_6.1.7600.16385_none_1a632a9b22180b83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sonic-tables-1cb1_31bf3856ad364e35_6.1.7600.16385_none_c4672e7a7e0b4d85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..yer-wmasf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b1d7a09da6868e13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_7041b95d9e5d428e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-programs-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_31dd540fb439b405\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-dvdupgrd.resources_31bf3856ad364e35_6.1.7600.16385_it-it_adbf0ad43faf972a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..igbackend.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bfbc6597dede2fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_39b468a7491888f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-jsprofilercore_31bf3856ad364e35_8.0.7600.16385_none_8156d54dc2123a1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tasklist.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bf04b2b8406842b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_628517ee00d3143b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.directoryser..anagement.resources_b77a5c561934e089_6.1.7601.17514_fr-fr_53949e4aa0158b47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mmres_31bf3856ad364e35_6.1.7600.16385_none_bacb7329f882f019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nwifi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c51a125f2d9b0534\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Windows_PowerShell_2.0.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_ab9479767ad67fd7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d67fded40c74e68e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7064752b59766042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnhp003.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3122f08f9905bfb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Command_Syntax.help.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..etintlerr.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2176fe9fd57f848c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-locatep.resources_31bf3856ad364e35_6.1.7600.16385_es-es_24fc7525ec519635\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ng-oleprn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0ed9de501a2d0660\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-lmhsvc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_870d8ab95fee92b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..sql-netlibs-winsock_31bf3856ad364e35_6.1.7600.16385_none_a39b4b21d21ea7b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..nvservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4598e37e22c1e587\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Iden1fe87377#\4c6cab2aa8b33a65a6b71a173f72767f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\190c40c1f98dddf624b7e442286d76d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_752e3bb068638683\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ender-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b8b5f50fea3a170d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0eaa73e1c56d6827\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f23d96c52b159c2d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\twain_32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_nb-no_9b8d0467f7e1805b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dot3gpclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_175e809fb6eddb8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_750424553b6757cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-dvdburn.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a22499f6e668efbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ng-wizard.resources_31bf3856ad364e35_6.1.7600.16385_en-us_39ab5497867c2816\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f4011b0ef5f3b00e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..acefilter.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_42ecffc1e45b84b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_es-es_dbc7c5d1d33a67b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msports.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d97aa19cecb4f211\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msident.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_50ed13d9717067a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\shell\open	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.crypto	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.crypto\ = "WLBBZNKOEAWJDDA"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\DefaultIcon	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\shell\open\command	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qAxMr02XPSFEbd2.exe"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\ = "CRYPTED!"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qAxMr02XPSFEbd2.exe,0"	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLBBZNKOEAWJDDA\shell	579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\579f0a2740ffc2304c75ebebe47c29a7_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
443B

MD5
ab1a8fac5478e77d2c9351652cac7288

SHA1
a7843a4af990fc4b4dfb484549258eef60037e22

SHA256
e6e856e12d2b572b2353642380b78c3a8d9333615a42034f1ab0121c976ca242

SHA512
25dbd2952db75f31df0b61541dff7e2f1d27b2760ce478c9cd27b971cdd05c1d2bf3d69fc9b1390ed20c3741c0e73cf90ce22e3606a2428d7cc3d02ef5a4a3c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
80d2ff49f4309770a5f8c9461e24d695

SHA1
87e84e1f2c6be1549687a007f5530cfd636d609b

SHA256
f16a1eed1bd146f539927ee574b94e22809bc3605bf4665b1ab5ec1390f08784

SHA512
ef8528921d949e59261b85c00f03a59bcc594ad02419af0027ee3beb479eee575fbe1b6430920aaba555dfbdd2da7878e106b53a36869cb419a4f8eab79bf933

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
a911850cbb237b7be4de5321256fd8ce

SHA1
c42a00e72998ba481c94117ebbf8a95369857d87

SHA256
eaf296a2982cda50d7846deb2b03797b2f18e40d725846374a1ab9fd8d8ca3f9

SHA512
b7085ca676e0dcda70b51a188d9e295aa5c855cb438e5d17741bff16c55526ac4419bde0e691637b95cefe0e27763679cbd7c2638a083e26c849e8df262cf49c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
8abb874324b67e4922212b160bdb0ef3

SHA1
218fba34b194219b3871eddd710a5d4c201c5c27

SHA256
137e7ac68d8bcdbd0296af7b2adb69b93b8c247b6a1391a6b3bf9b497eb45f18

SHA512
750039875cf9d9ace1df547ce389dc126ca0254e25cd2608537c2e53a9b1705a3f813c1fa8691e01937444678baee3b3d94f7554470cd192432da91be0d8e950

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
c689fed5ede59211de221838df180d3a

SHA1
f6fb55eaf9db0b9e39120e872077febefd069cbf

SHA256
a349af3c16deac06a7798271c29d5851f45f7619e08966acf555af6479bcaacb

SHA512
b0494ceb1d8740ed197000fd4c7ac6027375f06715c471d1bbb85166a380eb778c3d30ac673df11bfd86cf8113af3650c12dadf42f550b8f9390f36782cacba8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
fbfc1cb6aadc7bbcde6e559d8c613874

SHA1
7e0f7a3bdde3aff490215e439dc339c7a1411bbc

SHA256
c9bdeaf3438b8cc04e83bb5c290ad6e77b155160aa4ff889b51c95f3b7bf16c4

SHA512
360f82590469f2f3d334f4e444296ea5ac89ac3a56df366c2544402abe5b01aae559679227b08eb1460f8447162168f2b9eb572760fd5e019b7b9d7fead699b6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
a30548f8bc2933aa2c46f8e9ab7c69e5

SHA1
f6ab433c7a21ccb42219f7398295fcd723b7a8c3

SHA256
828075f11abbeef71eefa4fed5a66418e7b577480ef60ed66a0490736428a07f

SHA512
0f570c78e82849f59bb44af8283c9e54cfa95300bde985a7b32cbc5cb8c802efb290ee64c5eadcb007ec9a09bf32273db35b90e9b5e53ac685d8a81d011f20e3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
d8c6ce84eb95c017fef1799f3344c084

SHA1
bba95c5b120d31ca5d4bedf0d78901b7ca0cd215

SHA256
4ff0ccf2b339f8adfb5437e321e513a5ef8750659e0ad25a2fb83f9872c8d0a8

SHA512
7d89903c5e8df1469def291b02509a044ce192b7a1cd5f79fdcdde226cdd91a1a62cba07d15c8f3401c2c0877f7ac35febf33389bc8beb9d2fabe81dbf33148d

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
0ff9d1240f6c94d4ab6757f02fa3efc7

SHA1
b59296f78ace026db053186982470c58bc7b7de7

SHA256
872f3a3fe729ff43c941c56be07a47709af8ae6cf48599d41839fb27b4397365

SHA512
3bcb9f4065ab0b960d98feac48a148625cc8324b4f8976801d6e3b41cdff78a1d7e0800c19e5955ba2b57ef3b8b8feeea2e890ba3663df55d18a99b81d1fe3d1

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
9a89e04cda1208ed9c118fca0f8e831a

SHA1
9c7eb9b41b992120a0664238590a0fa51498c7da

SHA256
a8240978c4d4e5ccf985455374c112aa4969b6609878779f03002a0ea8501ec5

SHA512
5f6546f8cb5c493a8fe0a49a91ba1d24c26f185de70469504bd0e9d29395933f2dec056cf3a7e42aeeb68290d48265fba7a52221bc79ef64a8e386280cb8ce49

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
422b1410796993a0761f3b0481d695a1

SHA1
3d693d2cd9a1c5252e0f711ed2f6c778c12e343e

SHA256
56056c06ef720ede6b2d32170d106c47a89df363311023355abe73a03c4ac70c

SHA512
97f61439522d406f84b6945398393145628540408f49276c713f1883df56498102a727305cf0d7c4d93c4372d9de5ea72236910d3d9a3c48b629d7751c2d3760

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
922e50651c24f3424e2e2bd773663180

SHA1
1ae11c8456026eb38b8f8bcf17cdee2f5d22c1e5

SHA256
80f7be09e6bb92995f232a1fe6cb917ffa5b8ab8f43761888511b7f80a3d81da

SHA512
c2ec52cad05705cab95b3305017ff028127e7f3e63828b6df63f1ab3ec9b7d402e21bbb44ddd7ef6584fcfb0c746fe6fb1b55c8817635e0b4d2ab7b871e87397

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
12c869d37530a531ca957bfa86cc1bf4

SHA1
4bec4091f1237320d66a0ef028a137ace96d90fe

SHA256
c66c900f25a1e8fa2f4d95d3eb40a1e77844d10856f708cc5d4b65434d7437ff

SHA512
4e61c33bc14539e09f98e6cec8a1d05ec6aca8e78c0f48917572352f8501a0ba316299788eb72c08e0c9d93cab291355cdc0bf2e12f769edeaae7f8539460114

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
72be38ccc391bda4c5288e5d6b6242cc

SHA1
49ccfb4921d4b7bf39ff80e7fc6f4af4cdef187f

SHA256
9b68a0dbdb29d47039f7498f20f7863f8623b7aa87b53b40304fed2dafd46801

SHA512
8a26dd418767f50af2c937a60c9f27b9dbb647d65e2ec90cd5292131c24609f38b277ff4ea23ce342f751bff3c19c52a1daadbe815e963fb51e1a9d7ac64b4d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads