Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
a47562ddb085ab39b821c1d8ab078edf
-
SHA1
0d4e8e5549105ee8527c058dce6c390616ad14a3
-
SHA256
f70006713d13499db25cb78e7831a300457f83248cc8a245de67b180c607713e
-
SHA512
18b3ff273024fdd98f2eacc9825316a97ae9809d127ae4d16a6613a9093fa94804c736cdb4edef814ef76c92a2f8c5b640ce4d2b7b76e339fe581667189a29f7
-
SSDEEP
24576:dnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:m1K5ve1K5v
Score
10/10
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Lockfile family
-
Renames multiple (1109) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_neutral_eeaccb8f1560f5fb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\arc.inf_amd64_neutral_11b52dec8e94d9aa\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cxraptor_philipstuv1236d_ibv64.inf_amd64_neutral_b6a3e57df5bad299\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc11.inf_amd64_neutral_bb18e5f134c40c68\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_neutral_46f893a4f998bb46\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_neutral_81ba64c5b6150dd3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_neutral_b4e8ccc6ba210e97\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\ProfessionalN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW0460T.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_neutral_6c50ee5cb1ea2780\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\sl-SI\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\adp94xx.inf_amd64_neutral_4928c8870f6a1577\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_neutral_a4d6780f72cbd5b4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\modemcsa.inf_amd64_neutral_b64a610f1f09f267\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF6940T.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\el-GR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Enterprise\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NDIS\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5060t.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk7100t.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpf4400t.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiahp001.inf_amd64_neutral_aee49cdf3b352e58\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-BR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO3200T.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterE\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\adpahci.inf_amd64_neutral_b082e95ec9f8c3f9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_neutral_e853cea0022c059a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_neutral_4a983035eaabe2f4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\Amd64\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicE\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_neutral_ab477c4d805d044f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Unimodem-Config\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mobgjlobgjloadla.bmp" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Chess\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Common Files\System\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CURRENCY.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SAMPLES\SOLVSAMP.XLS a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\TableTextService\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBOXES.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN082.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImages.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099154.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Solitaire\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows NT\TableTextService\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178932.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBHD.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\StepEnter.mov a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-a..istant-ui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_918887daedcd830a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-class_ss.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f3523b5305bcc704\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.workflow.runtime.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_086ac2fb233fb22b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_c43c4e7ce9d27db4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..demanager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_08f9e041d393ae77\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_f1795577af1fbb6f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-desk.resources_31bf3856ad364e35_6.1.7600.16385_it-it_62e0a28e66b486d2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_50863b6e8dfa0a07\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..kexplorer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e393513a419397ec\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ringtone.resources_31bf3856ad364e35_6.1.7600.16385_de-de_95467811b4bf7eda\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..overy-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9a87350ecf476dc\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wdi-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_05f1523150728af4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wwanui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6b9c1c2ac460e70e\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasmontr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1f839378ad8f9d57\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..nese-domainlexicons_31bf3856ad364e35_6.1.7600.16385_none_4475ba47a78dc96f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_c2cef3909acee84d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\inf\ASP.NET_4.0.30319\0013\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\PLA\Rules\Rules.System.NetTrace.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_6.1.7600.16385_de-de_94c9843d817470cb\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-powershell-sip_31bf3856ad364e35_6.1.7600.16385_none_c46392851c63cf2b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ng-wizard.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dc2e277a7975301d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmcrtix.inf_31bf3856ad364e35_6.1.7600.16385_none_8a345ba26a11afd0\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..leshooter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bdadfd83b0b6c2d9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\inf\wsearchidxpi\0409\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_amdsbs.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_267caec07f213aec\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-vidclip.resources_31bf3856ad364e35_6.1.7600.16385_es-es_161ef265fcdeb2b4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..essprotection-agent_31bf3856ad364e35_6.1.7601.17514_none_64be3a8d04208144\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..lprinting.resources_31bf3856ad364e35_6.1.7600.16385_de-de_22f066809967f793\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_6.1.7601.17514_en-us_529035abb5972411\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\diagnostics\system\Audio\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\inf\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ef35b1a0fa00d6fa\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-irda-sys_31bf3856ad364e35_6.1.7600.16385_none_a82ec3c4b06e94ef\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..plication.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e869d360a3b8ef66\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9d69cd15f0f8b638\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnlx006.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bf74a39f319db515\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.directoryservices.protocols_b03f5f7f11d50a3a_6.1.7600.16385_none_83a19ecc10aa89e7\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\Help\Windows\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..e-ehdebug.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c5834f4c9a4b21b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.web.routing.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7201a230aa3e16fc\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-duser_31bf3856ad364e35_6.1.7600.16385_none_5a4b046c5dce176a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..rolviewer.resources_31bf3856ad364e35_8.0.7600.16385_en-us_bd04b63f94f3882a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..peeradmin.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6c8e7edb5ff661bf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nshhttp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1277606c6260258a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnca00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_19c79726da2703f6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..favorites.resources_31bf3856ad364e35_8.0.7600.16385_it-it_945741c2bf7a0d77\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_wsatconfig.resources_b03f5f7f11d50a3a_6.1.7601.17514_es-es_518e7d7811dbe059\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d2e323f10fc3c0ae\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..ience-common-logger_31bf3856ad364e35_6.1.7600.16385_none_6d459f5f2ecee31f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_es_b77a5c561934e089\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_hpoa1nd.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b081203b24b6b9f6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-ux-sppcc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_aef7b65c5dcbb178\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_27802bf3bb66b8ea\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..edstorage.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c9e31697c5d34471\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_server-help-chm.sys_srv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4c5025517928ee23\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_es-es_f7ba90cb0a551d23\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mmres_31bf3856ad364e35_6.1.7600.16385_none_bacb7329f882f019\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_umpass.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b2329ab261590022\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_microsoft.build.tasks.v3.5_b03f5f7f11d50a3a_6.1.7601.17514_none_e8818a0573561a67\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-migrate.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d54411c19ed7bbec\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_dd27dc7caf015a96\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ols-klist.resources_31bf3856ad364e35_6.1.7600.16385_es-es_890e4971f10372e7\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\winsxs\msil_microsoft.ink.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_208ac7bc493c9d12\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630B
MD597d61dd38158163712ff1f93b02185dc
SHA1aeeff9e4e9c82b7093cb222e038c1a6fcfcf06a3
SHA25687c7671f844922e5d75372ff60271462c1f19105dce05c36a49bcbb6f93284d9
SHA51223b9a3da5c54e3528e79ef2529619e9a3828eb049baa59a0f67c6102179f134fcde03f30d8d36b2078e89fd6a28fc107a9c03814cd0ceb32e70495f36eb1655d
-
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML
Filesize582KB
MD5f56491195b3a954dcc5dd5e00048a91a
SHA192a237b2aa3feb6fe1c3afea150e0f54e042c915
SHA25634cc72cbaaa63eba1d87684f673baae5229a28ce7b7a15b5d11405f75e0a1c8f
SHA5127fcf6a34d1dbb65be377762fdd81244bd024443200625bcb8a67fcfef2cf59a13423071ac5a6d96896cd176d6b349bb8c368e5c323079a266281e3bf536df6e6
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize2KB
MD5ff592bc169552829773d00d09875ea30
SHA1647881352b484e6d263d65b7f13b0a610ea7ea3b
SHA25651e0ea20015ff9a344b8cd07c79a6d2ffbf8f6bc6a6dd0a91952b2528abdd2d7
SHA51202aa598647a87f3ab8e95dba9c29f7f1fa8d4c9bf168b8004671e78afebdfcdb828acaaf599201597fe94bad83a66bc8b94b27a62b1daa3c3bcbcc75a8e8076b
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize6KB
MD5b4bd9236ebd2106184de8d1d866df857
SHA1e652e837c39ac98d2e3162e11d4c93bd6e7c7761
SHA2564c046a1e5d6c76fdfa7592bfc104a8667d72ef62d962742845043da7c7290e91
SHA5122feff093ce211e1e6068947a7f2bf0368d3d7ce36e52366f21f6c542e422c5e68b3536f8618c3c4c96133c10cb9ea588b55d32fe56052c4a5e7f81e67b937450
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize3KB
MD5092dfc02d4a10ba133d8d32ec96f5a5f
SHA1e9aefa4fdc1d0494c8914c55f3f23debf02d2b7e
SHA2567079605fc6865f78b9ac9d6ff2c8611fa0804213adf9f628cd065e8df92eb89c
SHA512694f47c6cd12c070e68e82f74cdd4d3e233bcfb9d4bc2d757cb81a2a67c46c29095f078917681ccb327e3c03f577f280e33d697b5f4ffa4a40b8cd51cacb60bf
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize5KB
MD56ca80853ad63c3339a3e86f0032c366a
SHA1f289a7affb66e23f21261f21b603f386d72c86fd
SHA25658b2aa242e7c29fa3369b83ad415d3fc309c761c2ea47506a692886f4e58ae52
SHA512a26f9c0c0f2d11826985672ef4333177664601c31a81cc3bcb4ca99bb0e1837d991983ab8685f222777375cd58a53a086cd8f0b3d5e42e41ce70260470359674
-
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
Filesize247KB
MD5a872098140c349bda5a42936de3c4a7d
SHA1d1f4923183c746b1f42e2906973d0b461d177570
SHA256132d6d5bfbec90d71a799d84873f229b3c814cd3d3e272f18fd1bd9c107b39b3
SHA51292885a56ca9d086369e929e174b24bf29d584e6b1ece54a1b9ed709dbf2c519fe17bd927c5fa396ac403461a272da2743995a97cab5eb8e5e9a7850f69916906
-
Filesize
807B
MD55f82b0c82bdad0e11e88f51f05355f7d
SHA1580947de3df7699d7dbe92ebad7843b51c3f3856
SHA2566c95514629cd959497f67c94218163202d04c73dbef409f9b14a8826228ba925
SHA512d0ecb309b1fa4bc6ab5de4985deb1661304993991a37b2987cac1dfe40074f2596e07dc756f043a8d67eac5e4dfc587b784edfa06432bd111158fc19c4099c8b
-
Filesize
806B
MD5748a8d140d5194966a250e950d40f441
SHA1bb586c7edc77bd3887c7e446358c11e4e97174ab
SHA256e6cbc3509610aa7c637d7d4f83c54be92a918ff4d65fcebea5a1201c1526c57f
SHA512aef089ce611126d81c85127ac2df2cc981f7b46978b162e391966902f154e8a876fc4d93468e14add06fffaf75506f767205163574ad4efe46c5431ab506c26e
-
Filesize
317B
MD55a0b4dd3d8f6fdf54103fd0001816f63
SHA1a988ebbe0d7c2c876680defbd253b1975457fc7d
SHA256f3f39acd473189ab9295d2dcf2e6197ba0ab850a82c4aa1ade5592ce1892c38a
SHA5126bd930896090b729ba992d21481c200cde2177a9dbcd5b7444356d694557f5ee518264f232fff6316fe6f824c1e107c54c330e3823e9f811a39e36f5c0b30d12
-
Filesize
21KB
MD582c6ac5e46c85206837e131eddfddd83
SHA1034737421748e5bfafd4e854534f3ad9fc9770c7
SHA25655cf8a93e707fb1962dcc46766d7c5f0f71b64f332a6117118f94d7cb95ff322
SHA512914b0c8f1d06e3b0b8c00bda75f227ed3864d048c2f69f0a331cbecef925ce68705afc53cdd041e430ccda931fd2605f5dc579ffe8beaa0acffdf4c51b162eb1
-
Filesize
8KB
MD5bbef149c3dcde06a394ba512422af3a9
SHA134b0e982f4d5d731de39b322d4824b6af6472627
SHA256f4097368dc6b67514f2991640d563bb52fc01c7fcda1c29566b9ed7208954cd2
SHA512595989ecf2d2bea0939dbf57faaa3bfb690166c17fb1d1da27b58871d54b3209d71c6e5489e983e5d6d3ad05fd97bf847a6e11bc9cbc9fcfc9535818b07e08be
-
Filesize
1KB
MD59ceb184e2a266d3bd7ee49d69f60c0b1
SHA185d584f08463901541033025c42cdc2d718f0bf6
SHA256b7e00794735ca81c2966cc03e93b5880504c98764ad9af3bd273c48c684218c5
SHA512f9f46dad610a9b033300c22a8373d30165cdfb3175800c4837232f98c6fbcc843b8666b6c3ae313931457b0576b1891cd3a2f9437aa68933d70d52a3751463b6
-
Filesize
49B
MD5bd6fc9ca96698344936b22ccef4ba428
SHA149fc5c771601ed5e3897908cf8b83b546821a6be
SHA2561003f1a53667e28e7952335498bdedd3377eae435189df01235b6602a5654823
SHA512095c01770b4f4e9f9fcb29c0ce290043f5c1de9c7b9767e7dd889aa25f3c103ac2dc8de5258a639aea477f649aaeb14687767a9912d6326503019369a1ed8ba6
-
Filesize
8KB
MD5546aaf9ef3bd5a5d57584730e8aa12da
SHA1009188fede09461fdeb7b7138bd47b4bce60a6c2
SHA256fdd0d7552e874aa61d24a097fd9c297616d4e0ef684906a17c8c9425bed52c00
SHA5125d6fd8a6332055afa3fcbc74a08638184bd322fc0d3da5180314438a6eb6e120b5d09c9fa0b89cea949a562522b16b9b7d49fa9a30438f0501a589c1d2f7bd2c
