Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2024 20:12
Behavioral task
behavioral1
Sample
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
-
Size
12KB
-
MD5
805242256e678b3b8a05aee3a997d0f1
-
SHA1
ec415649644c4f449739fa795a24dca01eeacb43
-
SHA256
e034e30ce286d730eb6338ef5626a8e15ba7d6b9a7f1158b2d2883005bae1287
-
SHA512
2c5d2e10d6370b4627606b49da1a0942a7c39da0f475f01614da2f3bdfd7359351f63b81194b2894bd7633834249b603ef409fe269da4574a0800979395e7aaf
-
SSDEEP
192:+/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMoGJf9:+ebFNw4Pk1itKkpAjjI2YpdmoM
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Nui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\halextintclpiodma.inf_amd64_7f59f2c73a7fab14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_42b97498c7087292\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputMethod\CHS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_78faaf2062860ce8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_smartcardreader.inf_amd64_33a0db63c0afb351\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_9076ffc34f080cc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_25779da6eca4810a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_8c1e04ee38482578\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp.inf_amd64_9effd93a75bc489e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_f2e8231e8b60f214\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatform.inf_amd64_b6b644565437983a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_ports.inf_amd64_181d494584779290\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdf56f.inf_amd64_1e78e192efc26192\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\downlevel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\International\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_efb36fdc260e8bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\intelpmax.inf_amd64_2ddee95f7a5d85db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl007.inf_amd64_41e31b5786c6884d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\itsas35i.inf_amd64_4f5850c71046b0cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\archives\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\UserControls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\Windows Defender\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1_es-es_bbaef18513264314\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ram-disk-driver_31bf3856ad364e35_10.0.19041.1_none_c051ee891e045c04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_en-us_4e3e966f06829cb5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.19041.264_none_c4bc376754eedc34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-application..-appcontracts-winrt_31bf3856ad364e35_10.0.19041.264_none_69003b4adc98d976\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx35linq-system.data.services.design_31bf3856ad364e35_10.0.19041.1_none_53a2b499950da9d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\1041\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..xe-common.resources_31bf3856ad364e35_10.0.19041.1_es-es_117eedfc8292c125\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..aml-phone.resources_31bf3856ad364e35_10.0.19041.1_es-es_189f4229f15696eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..owershell.resources_31bf3856ad364e35_10.0.19041.1_de-de_529a1358839faf0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-psmcoreserver_31bf3856ad364e35_10.0.19041.662_none_88b10bbde167d52a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..facturers.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b9f35dd7aad50504\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ddriverprovider-dll_31bf3856ad364e35_10.0.19041.1110_none_f1b21c499e57b756\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-onexui.resources_31bf3856ad364e35_10.0.19041.1_en-us_47204dba746e24ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.264_none_39a33f9dfdb389ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..rdataapis.resources_31bf3856ad364e35_10.0.19041.1_de-de_175d98210872462d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..opeerpnrp.resources_31bf3856ad364e35_10.0.19041.1_it-it_e7ebc91c3e26cebb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..dlers-speechprivacy_31bf3856ad364e35_10.0.19041.84_none_71cb925aafc461dc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-consolelogon-library_31bf3856ad364e35_10.0.19041.1202_none_fa14df42dc2de4f5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_it-it_b0c8455d4f6b47c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-aadauthhelper_31bf3856ad364e35_10.0.19041.1_none_7856fafd87fd6e57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_fdwnet_31bf3856ad364e35_10.0.19041.746_none_1921f7f1d2e0ffa8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..lientcore.resources_31bf3856ad364e35_10.0.19041.1_es-es_63633120d8ee1995\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..cher-tool.resources_31bf3856ad364e35_10.0.19041.1_es-es_9bbae8b0107bded1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wsp-health_31bf3856ad364e35_10.0.19041.1202_none_d9ee6c2e68df6581\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\INF\TAPISRV\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmmct.inf_31bf3856ad364e35_10.0.19041.1_none_0faec8e499c4bced\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cdpusersvc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_199e8ff4ee629cf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..etype-yugothiclight_31bf3856ad364e35_10.0.19041.1_none_95d76bd43a856b0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wvmic_shutdown.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_0742c34a62e86aa2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ldap-client.resources_31bf3856ad364e35_10.0.19041.1_es-es_9b7cfe16faec5327\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..services-remotepage_31bf3856ad364e35_10.0.19041.964_none_ed2cea3240bb8c78\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_bthmtpenum.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_fbc41e40c93d2041\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nt-uevwow.resources_31bf3856ad364e35_10.0.19041.1_en-us_f1d4cc964040ed40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.runtime.numerics_b03f5f7f11d50a3a_4.0.15805.0_none_48e44f14e7ab804a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommonInetCore\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c_securitydevices.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_500dd0edcc8d8195\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-xinput.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5ac10e7b104b7ec1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_en-gb_3a5aa599f86780e3\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ck-legacy.resources_31bf3856ad364e35_10.0.19041.1_es-es_0178261339906f2f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.19041.1_de-de_01cc256f97efbe04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32k_31bf3856ad364e35_10.0.19041.264_none_a129c4ef2dc8e3f1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m...appxmain.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_2af73366ef8b8185\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..files-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_37c80eaf011451c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota.resources_31bf3856ad364e35_10.0.19041.1_it-it_4175132fe455e45a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_intelpep.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_898a3b9284ebc205\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..h-library.resources_31bf3856ad364e35_10.0.19041.1_en-us_51218b1735947582\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ventextservice-core_31bf3856ad364e35_10.0.19041.1023_none_992c8b491d71d91e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ementmanifests-base_31bf3856ad364e35_10.0.19041.746_none_a3f2b036f8e7a3ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_presentationframework.resources_31bf3856ad364e35_10.0.19041.1_it-it_49736e1b71d3c599\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..onsbroker.resources_31bf3856ad364e35_10.0.19041.1_en-us_cab0561e44eb8c66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c253a41c298cb197\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-wmi.resources_31bf3856ad364e35_10.0.19041.1023_en-us_88575558071a16db\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ncrypt-dll_31bf3856ad364e35_10.0.19041.546_none_462c46e484cc1b15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\ = "CRYPTED!" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe,0" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mB3Tew2BDFbEH1s.exe" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "MQISXQQKMIDJKVK" 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MQISXQQKMIDJKVK\DefaultIcon 805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\805242256e678b3b8a05aee3a997d0f1_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290B
MD545f35ddbedac15a2a3a7849543dd9f65
SHA182f11f58c6ec43a262383fcb91347c5dc48d50dc
SHA256d3180592af35bcf9c70c24e6f1b11784c4a209167e38261b27f01a9ad36db5c6
SHA512c574be496143d89d41704fa3334a095a46d2270df68ca6213262ed66313fa620895f60461f156412be0c225da7e17b9d0fd4d34255c90bfc2441264da89d6612