Analysis
-
max time kernel
142s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2024 08:40
Behavioral task
behavioral1
Sample
6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe
-
Size
87KB
-
MD5
6152d82cdc94bf202d8284bb0fd1e803
-
SHA1
c5626eddbebc428f13bfa7f07eea88bd7ff13ce6
-
SHA256
0d7e8459bd8ebab98011beafc0c00b7e3567568c59b201671b13d0169f4dc9e6
-
SHA512
8615ed5283d825f107db236ecf25f4f42fd9f8c7b0cccf865acc9d299c7bba4b1d8951da6b6ee5351c767af0870a6458c78092e1ec562b69d77e0954f6bd4e5a
-
SSDEEP
1536:LiiZpLhQ6wWd0gHLn5SlDuwlJmOBRjM0BXh3ZEv9FyFKeSl8k0nCdMuC:OgpLhQ6NdVHLn5IDuIB/A0BXhps9A7+S
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Renames multiple (510) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_95e01117eb9c1bd2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_e87e378eb673af65\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas2i.inf_amd64_ed501deb0beeb5cb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icsxml\potscfg.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vca.inf_amd64_6bbc643de0df118d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_be5d923b5e701b62\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_9d8718c8b82a0aeb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\MSxpsPS-pipelineconfig.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic_heartbeat.inf_amd64_ad33c2d1c7a3023e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\de-license.rtf 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lpeula.rtf 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_computeaccelerator.inf_amd64_9d34992b3634b396\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\percsas3i.inf_amd64_c17a63dada1eaa02\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icsxml\ipcfg.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icsxml\pppcfg.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmagm64.inf_amd64_7f60bc7ff484a292\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\AdvancedInstallers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidtelephonydriver.inf_amd64_43fa6b1db642df7e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_911a60fb265ff111\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_220e4fad6c84d016\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\virtdisk.inf_amd64_9a7f42b85c7def50\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mobeggjlooaddgff.bmp" 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2376-0-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-4332-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-4309-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-7978-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-7979-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-7984-0x0000000000400000-0x00000000005CE000-memory.dmp upx behavioral2/memory/2376-7988-0x0000000000400000-0x00000000005CE000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\da-dk\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\x86\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxManifest.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.jpg 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\is-IS\View3d\3DViewerProductDescription-universal.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\Common Files\System\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\AppxManifest.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxManifest.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\canvas_dark.jpg 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\AppxBlockMap.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_product-onecore__mi.._a2dp.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4823319f5f2db858\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..infrastructurewinrt_31bf3856ad364e35_10.0.19041.1266_none_1f2c9276bb0793cc\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..t-winproviders-appx_31bf3856ad364e35_10.0.19041.264_none_2feb883e3f388bf2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\DiagTrack\Scenarios\windows.diag_ondemand.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-ram-parser.resources_31bf3856ad364e35_10.0.19041.1_es-es_508d9b30774611df\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasctrs.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_18a25ca0706683f9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mily-authentication_31bf3856ad364e35_10.0.19041.264_none_95a1c6864140fd72\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-common_31bf3856ad364e35_10.0.19041.1052_none_78b0fc67c548b523\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_datasvcutil.resources_b77a5c561934e089_10.0.19041.1_ja-jp_5c9e1df4f35d6fea\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-appx-alluserstore_31bf3856ad364e35_10.0.19041.153_none_0c1682a78b2f084d\AppxProvisioning.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..worker-v2.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_77da0af32856c5a2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ui-shell-adaptivecards_31bf3856ad364e35_10.0.19041.746_none_7a604becdd5c855d\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1e6a78b1d4535ff9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rface-ldap-provider_31bf3856ad364e35_10.0.19041.1_none_d21e89e69a4710fe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..itefilter.resources_31bf3856ad364e35_10.0.19041.1_de-de_4923f6ebe6067389\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifidisplay_31bf3856ad364e35_10.0.19041.1_none_a7cc6a3e80623078\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a8b91ad8b35a39fd\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ru-ru_f212f1ebceb5ba45\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cementmanifests-net_31bf3856ad364e35_10.0.19041.867_none_95544fbb82423b98\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk.resources_31bf3856ad364e35_10.0.19041.1_es-es_6651323d16bc8d3e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.channels.resources_31bf3856ad364e35_4.0.15805.0_es-es_3ad649be93a7fe94\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.managemen..imcmdlets.resources_31bf3856ad364e35_10.0.19041.1_de-de_e41aa46b3c2cb53c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_system.data.sqlxml.resources_b77a5c561934e089_10.0.19041.1_it-it_a90334d6801afd1e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..phoneutil.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9a482e53784bcf25\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\n\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\tokens_esES.xml 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devices-midi_31bf3856ad364e35_10.0.19041.746_none_c8d36e2efa765486\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-directinput_31bf3856ad364e35_10.0.19041.1_none_d38927bfab0c4442\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.iis.power...commands.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9cfbb9ac3ff9af04\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_lv-lv_642b8f0070c4d4ce\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-filter.resources_31bf3856ad364e35_10.0.19041.1_es-es_82c60e8a884488a6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..-backgroundtransfer_31bf3856ad364e35_10.0.19041.746_none_f4331ada712783ea\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\TaskScheduler.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\rescache\_merged\3937681233\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dmo_31bf3856ad364e35_10.0.19041.1_none_d0874ed19e069aca\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.264_none_92ee62a6d5b1c18a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..playcolormanagement_31bf3856ad364e35_10.0.19041.1266_none_2fd7978944011052\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..libraries.resources_31bf3856ad364e35_10.0.19041.1_de-de_678f1619a01c7922\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..access-unifiedstore_31bf3856ad364e35_10.0.19041.746_none_e927d31d789979b5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.archive.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f51ff8d92a653f4d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_et-ee_a27d02ab81dd8cd2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Xml.Resources\2.0.0.0_de_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.19041.1_de-de_0f07ff385f4cd189\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_dea978ecb8abd5f5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netvf63a.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_f465fe5b5e50823a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.19041.264_none_bad3ba5692b129e5\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.OracleClient.resources\v4.0_4.0.0.0_es_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-enrollengine_31bf3856ad364e35_10.0.19041.1266_none_0da9b93573cd9ce7\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..band-experience-api_31bf3856ad364e35_10.0.19041.1081_none_6e71490dbda799c0\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..elmanifests-windows_31bf3856ad364e35_10.0.19041.789_none_7f2fef395b7423e9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..d-dialogblockerproc_31bf3856ad364e35_10.0.19041.844_none_182aee3d6a23fee2\n\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ialoghost.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_5716db6edd86234c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ci-wmi.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_865b38ba18d5b1bf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..cfgclient.resources_31bf3856ad364e35_10.0.19041.1_de-de_2ec17156eaff49cf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell 6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6152d82cdc94bf202d8284bb0fd1e803_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630B
MD597d61dd38158163712ff1f93b02185dc
SHA1aeeff9e4e9c82b7093cb222e038c1a6fcfcf06a3
SHA25687c7671f844922e5d75372ff60271462c1f19105dce05c36a49bcbb6f93284d9
SHA51223b9a3da5c54e3528e79ef2529619e9a3828eb049baa59a0f67c6102179f134fcde03f30d8d36b2078e89fd6a28fc107a9c03814cd0ceb32e70495f36eb1655d
-
Filesize
331KB
MD50e6b213281e110f267915397f29a7cc1
SHA142905bb9106e8eee62fcb65f5a5233f3f4fba7a5
SHA2563f3514097417d76e91f0a1b86228875d9966b973cd9ecc80b6331ec1a98a4496
SHA512f0b4bffa65f49f3be9e80dc96df9a2ba3fd65ee82cf7e062b21328a911d6204228b2cf685a237518810a0ec95485aec456b6333bb7b02735d68ed8ee27ae1515
-
Filesize
317B
MD55a0b4dd3d8f6fdf54103fd0001816f63
SHA1a988ebbe0d7c2c876680defbd253b1975457fc7d
SHA256f3f39acd473189ab9295d2dcf2e6197ba0ab850a82c4aa1ade5592ce1892c38a
SHA5126bd930896090b729ba992d21481c200cde2177a9dbcd5b7444356d694557f5ee518264f232fff6316fe6f824c1e107c54c330e3823e9f811a39e36f5c0b30d12
-
Filesize
21KB
MD582c6ac5e46c85206837e131eddfddd83
SHA1034737421748e5bfafd4e854534f3ad9fc9770c7
SHA25655cf8a93e707fb1962dcc46766d7c5f0f71b64f332a6117118f94d7cb95ff322
SHA512914b0c8f1d06e3b0b8c00bda75f227ed3864d048c2f69f0a331cbecef925ce68705afc53cdd041e430ccda931fd2605f5dc579ffe8beaa0acffdf4c51b162eb1
-
Filesize
8KB
MD5bbef149c3dcde06a394ba512422af3a9
SHA134b0e982f4d5d731de39b322d4824b6af6472627
SHA256f4097368dc6b67514f2991640d563bb52fc01c7fcda1c29566b9ed7208954cd2
SHA512595989ecf2d2bea0939dbf57faaa3bfb690166c17fb1d1da27b58871d54b3209d71c6e5489e983e5d6d3ad05fd97bf847a6e11bc9cbc9fcfc9535818b07e08be
-
Filesize
1KB
MD59ceb184e2a266d3bd7ee49d69f60c0b1
SHA185d584f08463901541033025c42cdc2d718f0bf6
SHA256b7e00794735ca81c2966cc03e93b5880504c98764ad9af3bd273c48c684218c5
SHA512f9f46dad610a9b033300c22a8373d30165cdfb3175800c4837232f98c6fbcc843b8666b6c3ae313931457b0576b1891cd3a2f9437aa68933d70d52a3751463b6
-
Filesize
49B
MD5bd6fc9ca96698344936b22ccef4ba428
SHA149fc5c771601ed5e3897908cf8b83b546821a6be
SHA2561003f1a53667e28e7952335498bdedd3377eae435189df01235b6602a5654823
SHA512095c01770b4f4e9f9fcb29c0ce290043f5c1de9c7b9767e7dd889aa25f3c103ac2dc8de5258a639aea477f649aaeb14687767a9912d6326503019369a1ed8ba6
-
Filesize
8KB
MD5546aaf9ef3bd5a5d57584730e8aa12da
SHA1009188fede09461fdeb7b7138bd47b4bce60a6c2
SHA256fdd0d7552e874aa61d24a097fd9c297616d4e0ef684906a17c8c9425bed52c00
SHA5125d6fd8a6332055afa3fcbc74a08638184bd322fc0d3da5180314438a6eb6e120b5d09c9fa0b89cea949a562522b16b9b7d49fa9a30438f0501a589c1d2f7bd2c
-
Filesize
62KB
MD5d63dfe04f005ed75846cf5e822057ae7
SHA1e4f817021c63e6c585358fcfca32a107a4abeedd
SHA256582a60a60390cd7b078c158226ca897b02274d0d826c8749b3a38b7b0ac7cd77
SHA512e421f18414950423704fea20e5cfc4f87e47f5182c76873050aa0e985bb9e867b36d0d8aac778a986aec71718f223c75183fb92aa12b6d300e67b1eb5775990f
