Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe
-
Size
614KB
-
MD5
7646a52f439e5f5a9bed9eb26b0f27c2
-
SHA1
14dc02d98f2bc3cfc10f60c810b00a4c35c4eeab
-
SHA256
90a2b693c05d9aecaa42e3e75ef8028bcc8dd7c55e476fbf8dbdfbe4b3b07030
-
SHA512
13d8777acfcff520a07f1af6c74b40e2b49e87e49884e765218cfea9063d0d9e8b39854ac6c0f70475164b21dc381b456ae269c4a7194e50b09dd1a4a09ba12f
-
SSDEEP
6144:hr0SYomWS//JmcZiWE58TR45SYomWS//JmcZiWE58TR4:nYomWS//JmcE2YomWS//JmcE
Malware Config
Signatures
-
Renames multiple (519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6a68abcc31aaa333\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ja-JP\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bthoob.inf_amd64_c6923052f60677d9\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_2afbe7d3ad20f42a\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_f1a7a2fbd6554d60\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\it\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0404\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationheadset.inf_amd64_47c7e539c0156424\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\Amd64\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\de-DE\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\sr-Latn-RS\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_camera.inf_amd64_7b52a9607d24ece6\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fshsm.inf_amd64_48c6ccb73844d3bb\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\pcmcia.inf_amd64_cb18bba4788e47f7\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\en-US\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\de-DE\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_0eaf27d749819837\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmscli.inf_amd64_b39ea5f4658998de\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\MPDW-pipelineconfig.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_b401376fd0a39c95\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_310dc613a7e31ec8\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_e87e378eb673af65\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm\0411\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\de-DE\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_61883.inf_amd64_2c1769df23d261a5\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\es-ES\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-TW\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhayes.inf_amd64_055d85baabbda8f6\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\MSxpsPCL6-pipelineconfig.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\lpeula.rtf 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\lpeula.rtf 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\hu-HU\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_74bb5e3e01cfd526\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Nui\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\fr-FR\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjmobddgjknaacfh.bmp" 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nl-nl\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\3DViewerProductDescription-universal.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.jpg 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\ImmersiveVideoPlayback\Content\Shaders\LoadedModelShaders\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hr-hr\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\it-it\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\it-IT\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Crashpad\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Fur.jpg 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\cs-CZ\View3d\3DViewerProductDescription-universal.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\en-US\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Notifications\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\msil_microsoft.powershel..s.utility.resources_31bf3856ad364e35_1.0.0.0_es-es_255ec101005b0aff\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autoplay_31bf3856ad364e35_10.0.19041.1_none_66e83389c17b2091\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-fr-fr-onecore_31bf3856ad364e35_10.0.19041.1_none_926835e1ef93be8b\tokens_TTS_fr-FR_hortense.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netvg63a.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_09e9eabea4a97b11\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwanapi_31bf3856ad364e35_10.0.19041.746_none_81ff90487c3f8018\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wvms_vsft.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_aa7b128d6a2acc7f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.virtualiz..vmbrowser.resources_31bf3856ad364e35_10.0.19041.1_es-es_f287c4684874aa25\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-mediaplayer-wmvcore_31bf3856ad364e35_10.0.19041.1202_none_1fd41533d2b067a4\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Resources\8.0.0.0_es_b03f5f7f11d50a3a\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..entsnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_b9dfe4fd58a7240a\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_d4df49dad566c931\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-integrity-policy_31bf3856ad364e35_10.0.19041.746_none_8a20106aa387072c\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ytools-ex.resources_31bf3856ad364e35_10.0.19041.1_en-us_bba552432658873d\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-core-tsp.resources_31bf3856ad364e35_10.0.19041.1_de-de_7b601ab5ba6c0c87\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\INF\MSDTC\0C0A\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-graphics-wdi.resources_31bf3856ad364e35_10.0.19041.1_es-es_e0d5286d9617c423\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndis_31bf3856ad364e35_10.0.19041.746_none_85c076937ade51dd\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netelx.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_a61626d78ff2fe3b\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-themecpl.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7914b51c4f8f2e00\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.19041.423_en-us_c99b855b8edbac2b\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wfpipsechelperclasses_31bf3856ad364e35_10.0.19041.964_none_507f3b8f5adc2210\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..r-library.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5295409ec6f0a2ab\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5fdd841c6398619a\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-dv_aspnetmmc_chm_b03f5f7f11d50a3a_4.0.15805.0_none_903145418de7e82f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.1_none_ef230558c150a821\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spb-classextension_31bf3856ad364e35_10.0.19041.1_none_6fe049417df680da\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-cpl_31bf3856ad364e35_10.0.19041.388_none_3f3e847bf35a0410\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wsdapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_5dd5975bcef2f854\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.1266_en-us_2d9ea7f6426cfa21\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Sessions\31135901_1001110385.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkicon_31bf3856ad364e35_10.0.19041.1_none_0544c644a157f1c6\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.1_none_f59d207965b1bbc3\ipscat.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1031\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_storfwupdate.inf_31bf3856ad364e35_10.0.19041.1_none_f9ee98fddb5b4229\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_lv-lv_9c193dc75ecc0b4e\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_perf_ini_b03f5f7f11d50a3a_4.0.15805.0_none_207fddeead1ca79d\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-defender-branding.resources_31bf3856ad364e35_10.0.19041.1_de-de_c34d7c8fb9de763d\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.virtualiz..vmbrowser.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f6813f37a7774b6\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cationmodel-daxexec_31bf3856ad364e35_10.0.19041.1288_none_3488a3ed0a497e26\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..anup-task.resources_31bf3856ad364e35_10.0.19041.1_en-us_22af5b26af954aa7\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..es-ntdsai.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0e0137fc170149b3\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ngshandlers-flights_31bf3856ad364e35_10.0.19041.746_none_1c4fa74bb06cbe36\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-inkfree_31bf3856ad364e35_10.0.19041.1081_none_87beae98bb645f2f\f\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..lders-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b92fb725e0abdb11\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysdm.resources_31bf3856ad364e35_10.0.19041.1_it-it_832a8a2b836c46d6\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapi3_31bf3856ad364e35_10.0.19041.1_none_218e69a0634eb631\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Diagnostics.xml 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-forwardplugin_31bf3856ad364e35_10.0.19041.1_none_2b5b36de8d376f2c\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..overy-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_036fec1172c7e855\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..xecserver.resources_31bf3856ad364e35_10.0.19041.1_en-us_cc7def7e14ad13f3\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..atecontract-desktop_31bf3856ad364e35_10.0.19041.746_none_692666eeada9435b\r\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootmenuux_31bf3856ad364e35_10.0.19041.1266_none_69a7682dca8f3b65\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-network-setup_31bf3856ad364e35_10.0.19041.1_none_5dd26c4f87bf6b87\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..gement-vdsinterface_31bf3856ad364e35_10.0.19041.1_none_659dbe30f2c106b5\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx35linq-microso..uild.utilities.v3.5_31bf3856ad364e35_10.0.19041.1_none_d9377eac1a538bd0\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\hr-HR\ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.5043 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\ = "CRYPTED!" 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0wi87Y962nNss4s.exe,0" 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\shell\open\command 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\shell 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0wi87Y962nNss4s.exe" 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5043\ = "AUBYUGMEGMROSLL" 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\DefaultIcon 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AUBYUGMEGMROSLL\shell\open 7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7646a52f439e5f5a9bed9eb26b0f27c2_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
905B
MD54f96659ec995be3d93c06fe39c89e3df
SHA11f7357fc113e519f6547f5e7742583426ee89c81
SHA256882ac9bf649bee58fe58513e5a91fc301c08a988df83baeee56968538848e1fd
SHA5124cd5e53044785973d2ebc54ae49a1e101fa42198cbaba1c9eb7d30e7787b06ccec690f068d598aa0a4a1244d1cb8b036e75534c7764d911212039fbe71d7c3db
-
Filesize
332KB
MD57b299dc9615a04baddda789c23badcbf
SHA1f6df70c56fffc524697dbda261b4988e7582c1dc
SHA2560b1dbae4c3ef76e85e174c7a63a253e3ae8c9d084f84cac9b520791a258c5b9c
SHA51297e4f7427114c7e21987f921e29eca36933b5eb798c38626c766c11a47632228c85a86f69cf13aa8d361d50017f970ea6489e64d538626be65aa4fcadb08bf45
-
Filesize
317B
MD5d41600f7da09bfc791dbc77409a22588
SHA19f89a9acab5ea66d9bfeda64432f146d8e0bc7ce
SHA256dc61d1875ef28521d0f9ae33fd5e6e0c8699f26e556a65832ec3f2364f2d51f6
SHA5127a91a8f9a595537d992fec9210d5b4985ff8d246e86d5a37d9e5511cbf447681c07451911469bd1b8011d47f5eb202004f763311c22f776aa29a7090f78f16a1
-
Filesize
21KB
MD5db9f1a58559f143c4a907a344b9ec6e5
SHA159ada49413804a765de81c073ee279c4e8645dd1
SHA256b866fac08c049d398b54f2e191eee3534169c49bb30894b7b9e8dd8c89ea0055
SHA5120b76a2ca4e469d10616ad1560cf0a240c534c145e423e642c792a5c1599d14afcfb9b5c93f519c7e3911dbe4f5ff792ca3564d64d4d19a39c1e79ac97e966b2d
-
Filesize
8KB
MD5b504273d017233f4b151846505f30e50
SHA1dc474e86c5316a4e76e50bc617c55c007a9048ca
SHA256df364d483baba875558703f8cd24952da1c619397b036d216283dfc8f862f3c0
SHA512836d43442622d748e5457a6c9df45828b3c144eda6728f4996c8a257293731ac4f736261037cfd67d58aeda9471c4c3d917a98069ed291c412359acdfe71fa11
-
Filesize
1KB
MD5c63e3cb361b7501d24a671130a7b481c
SHA10aa25458ae39266f4c3dd32fd2f51b9b64bf3f88
SHA2562ac09223e2bfa9abd6d1f975cd3dac383a02710ee8184b084b0c4d57d054d2a0
SHA51228e069714630dee8ce2f34c4cafc980933f6f218c94b8b5724dac0cd5bbce76292821250a43f54152b8e3103f87683ffa5c6fe84cc72df89780ce4fc9547f437
-
Filesize
8KB
MD5173276c633dd374114b638ebaa100415
SHA107b79ecf7aa8f9661dc60d006ce3c60d72cf11a8
SHA2567b546c76bcd4070cfc3279e4f2459b761643f5f64cb663f3004a33dd22e764cf
SHA512ac9a0b1031cdf0dc8cfcfd11618de4dcdb1d1f6dad811cd3bb5a75848245c4a5cefd7ac5aec8715c884f0411a4befc124a28f4fc464d8c51f1964a2138c34792
-
Filesize
62KB
MD5fc89d79ccf040539651f5cdd1f9bab15
SHA1e2eb11dbf785ede2a7e182f1f5558acf2992269d
SHA25628e6416e94160ea4970dc749b071667e1e9c7ce34f3e19189ea248c98634b474
SHA5129a92e32d0c1fac9d4ab636b87dfa092f3d54ccda759dc6271d7a8c283d50c555a323f4c25fb6857974fe5489eef3517a3feb9ad297194ae7a14bedc6bafaa712