Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 20:12
Behavioral task
behavioral1
Sample
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
-
Size
12KB
-
MD5
805242256e678b3b8a05aee3a997d0f1
-
SHA1
ec415649644c4f449739fa795a24dca01eeacb43
-
SHA256
e034e30ce286d730eb6338ef5626a8e15ba7d6b9a7f1158b2d2883005bae1287
-
SHA512
2c5d2e10d6370b4627606b49da1a0942a7c39da0f475f01614da2f3bdfd7359351f63b81194b2894bd7633834249b603ef409fe269da4574a0800979395e7aaf
-
SSDEEP
192:+/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMoGJf9:+ebFNw4Pk1itKkpAjjI2YpdmoM
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl007.inf_amd64_neutral_935cd017fcb965ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_neutral_379fb0c62496be6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnova.inf_amd64_neutral_b52d8db82d8c3be9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_neutral_ae5de2e1bf2793c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbr006.inf_amd64_neutral_40c76453575b1208\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_neutral_27c5b45728cc9ed0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx003.inf_amd64_neutral_db618863f9347f9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_neutral_f91980f20f3112ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Usb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaky002.inf_amd64_neutral_b898f5982403f3cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Unimodem-Config\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_neutral_e567adb271831b5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm005.inf_amd64_neutral_c03c9e328608873e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_neutral_1975687236603184\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_neutral_41c6262952846788\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c64.inf_amd64_neutral_30b0b06f47cab8cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr009.inf_amd64_neutral_2d7b3edfda95df40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkLoadBalancing-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_neutral_3c11362fa327f5a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhrtz.inf_amd64_neutral_10affee00545fb45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Journal\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\include\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Mail\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{C3A4D3BC-D67A-4D2A-B0ED-B4E62D27E02C}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-s..solitaire.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83aa96eb723f360f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-fde.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bd2e1a2e17661289\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..docs-main.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ee8df911360b6dc0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.1.7601.17514_none_373ecc0d14680e72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnky006.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a8d49dda588056ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog-api.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_224e653d642d7a4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-u..evicehost.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d7fa0453ba534c46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..unddriver.resources_31bf3856ad364e35_6.1.7600.16385_de-de_210d66fabcd42073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_6.1.7601.17514_none_91a9e7972ac8981f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..k-msctfui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5bb44a6ccc2f2a34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a9f1d6155674f92d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speechcommon_31bf3856ad364e35_6.1.7601.17514_none_34284e05e94a6f7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..haringapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_993e1611cd45c734\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-mpeg2_31bf3856ad364e35_6.1.7601.17514_none_1435300cb8e4b445\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.data.linq.resources_b77a5c561934e089_6.1.7600.16385_de-de_4b5d7fbf7a2edfb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-peerdist_31bf3856ad364e35_6.1.7600.16385_none_836e3056382e745c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..iders-msi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_877dac5e8ab2774e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_crcdisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b101c5afe5ce5e39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..on0viewer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ad7776009a0be175\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-wmpnssui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6b8f9946dec9fa62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a8f3f70ef3c58505\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cf0f5fcc4a71438d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ui-pmcppc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_03b2a5eef074426f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msasn1_31bf3856ad364e35_6.1.7601.17514_none_25801b39bc00ed6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00060408_31bf3856ad364e35_6.1.7600.16385_none_235c0abc5fb15133\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_fdrespub.resources_31bf3856ad364e35_6.1.7600.16385_it-it_41991f13eb65acc5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6aa2e3afc3c85aa5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-locatep.resources_31bf3856ad364e35_6.1.7600.16385_es-es_24fc7525ec519635\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_cde4c4fd7ab159cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_de-de_faa01a50be0096c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..relevated.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b49caeeba6cc4d95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-complus-ui_31bf3856ad364e35_6.1.7600.16385_none_b07e19d8a98c26cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-v..r-windows.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_48068df8135ae33d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..p-cleanup.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e99cc8d30e9afebf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-advpack.resources_31bf3856ad364e35_8.0.7600.16385_de-de_04e6300aaa71cf74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..putername.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0202957a15d38086\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f0e6b9729f6b6972\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ity-vault.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4e84bc7e23f68b55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-webio.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_002271384242c2c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting-vbscript_31bf3856ad364e35_6.1.7601.17514_none_a68008be44868d8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..etoolsmqq.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_aabfc110b1eca80c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.web.mobile.resources_b03f5f7f11d50a3a_6.1.7601.17514_es-es_94e81ac37271f69d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-console_31bf3856ad364e35_6.1.7600.16385_none_f24e4c08c628068a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dfsclient_31bf3856ad364e35_6.1.7601.17514_none_e5c0334cfcbb6f1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-driverquery.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fb8a0938cef85ddd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepadwin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f51dc315e4ca5723\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_msclmd.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_23b78ec1df66bda9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnep00l.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b4aa016ba6df7434\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_nb-no_03f6001a44de7439\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-msident.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ae6a40f67e775f9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_bth-user.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4f5a31a35cc984ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmtdkj6.inf_31bf3856ad364e35_6.1.7600.16385_none_0c478d2003001361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_6.1.7601.17514_lv-lv_ce049ed96758c5d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wincal-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_719a799bd7c094a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wiabr009.inf_31bf3856ad364e35_6.1.7600.16385_none_0a89942916508ec8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ehome-ehdebug_31bf3856ad364e35_6.1.7600.16385_none_9627531ad053d23d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-autoplay_31bf3856ad364e35_6.1.7601.17514_none_a8a9e59f4bfef126\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20866_31bf3856ad364e35_6.1.7600.16385_none_53e1c8c7465becbb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-medexptv.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_108e136bd8ccaa8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MQISXQQKMIDJKVK" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\ = "CRYPTED!" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe,0" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290B
MD545f35ddbedac15a2a3a7849543dd9f65
SHA182f11f58c6ec43a262383fcb91347c5dc48d50dc
SHA256d3180592af35bcf9c70c24e6f1b11784c4a209167e38261b27f01a9ad36db5c6
SHA512c574be496143d89d41704fa3334a095a46d2270df68ca6213262ed66313fa620895f60461f156412be0c225da7e17b9d0fd4d34255c90bfc2441264da89d6612