Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
a47562ddb085ab39b821c1d8ab078edf
-
SHA1
0d4e8e5549105ee8527c058dce6c390616ad14a3
-
SHA256
f70006713d13499db25cb78e7831a300457f83248cc8a245de67b180c607713e
-
SHA512
18b3ff273024fdd98f2eacc9825316a97ae9809d127ae4d16a6613a9093fa94804c736cdb4edef814ef76c92a2f8c5b640ce4d2b7b76e339fe581667189a29f7
-
SSDEEP
24576:dnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:m1K5ve1K5v
Score
10/10
Malware Config
Signatures
-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
Lockfile family
-
Renames multiple (515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_167948d0c94abc27\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_144351277838b429\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0404\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\lipeula.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_sdhost.inf_amd64_b71f983cb35bfde3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\intelta.inf_amd64_ba962d801a22973c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\tsprint-PipelineConfig.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\fr-FR\tokens_TTS_fr-FR.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\unishare-pipelineconfig.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\whvcrash.inf_amd64_1173082afb4becfd\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tpm.inf_amd64_154e6da862a6dc30\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0007\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\xsl-mappings.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_b6cb67052996a0bf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\th-TH\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_cc4dba2066ccf53c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\unishare3d-pipelineconfig.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-GB\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\002d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_767b2d723d0fe83b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_de71647ec29a6bc2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyxel.inf_amd64_1edcf626fd489056\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\fr-FR\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\AdvancedInstallers\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\it\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_db80a6e1be3a2d08\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\MSMPS.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\uk-UA\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_ports.inf_amd64_181d494584779290\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cffknnpcfceehkmm.bmp" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows NT\TableTextService\en-US\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\da-dk\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\de-de\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\whatsnewsrc\script\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VC\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\View3d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\skins\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\pt-br\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\eu-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\AppxManifest.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinTranslator.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fr-fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\WinMetadata\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\da-dk\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ta-IN\View3d\3DViewerProductDescription-universal.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunMailBlurred.layoutdir-LTR.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\en-US_female_TTS\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\include\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-alacdecoder_31bf3856ad364e35_10.0.19041.1_none_9379d50fe20f4682\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.19041.1_none_7957f8902b2072a6\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_10.0.19041.1_de-de_6e8e2bde3fecb36d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000438_31bf3856ad364e35_10.0.19041.1_none_a04d9fb90196ac99\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wificloudstore_31bf3856ad364e35_10.0.19041.746_none_13a7a08ded01671c\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-wmiclnt_31bf3856ad364e35_10.0.19041.546_none_d3eefbf5eecbb6e3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_fdc.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6641ecfa4cc2e918\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_10.0.19041.1_de-de_297d303ee0a8c50c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dedup-chunklibrary_31bf3856ad364e35_10.0.19041.746_none_a4740d31559ff6bc\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.19041.1_none_303c934463211164\windows.diag_ondemand.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wow64-windows_31bf3856ad364e35_10.0.19041.207_none_d60b7878e55efcde\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msmpeg2vdec_31bf3856ad364e35_10.0.19041.84_none_92ef0c501a803372\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui-appcore_31bf3856ad364e35_10.0.19041.264_none_79ff08e5ee1537be\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bitsdiagnostic_31bf3856ad364e35_10.0.19041.1_none_023d0df5c3f06a00\BITSDiagnostic.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..extension.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_72d0cf4ac732aa0f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.19041.546_none_a5535ccb0430ada2\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpssdp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8498a4297bcdef63\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a...appxmain.resources_31bf3856ad364e35_10.0.19041.1_es-es_ec5721bc1171e90d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rd-module.resources_31bf3856ad364e35_10.0.19041.1_es-es_d91eac78e1174304\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fcaaaf28261949ea\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_vsmraid.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7bbbb3c24fc94022\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_multipoint-wmsmanager.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e3c406c3fa6f6e14\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.dscresources_31bf3856ad364e35_10.0.19041.1_none_5ab46b9671589b69\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bits-client-core_31bf3856ad364e35_10.0.19041.153_none_04304b75e9b1037f\f\315818c03ccc2b10070df2d4ebd09eb6c4c66e58.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7da5827f83dbffcf\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_228591433b6cf074\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e177eabb54a49404\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32k_31bf3856ad364e35_10.0.19041.264_none_96d51a9cf96821f6\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..yer-setup.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c3bdc2992f6460a3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-peauth_31bf3856ad364e35_10.0.19041.1266_none_7ce519ea3ed77360\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_sr-..-rs_7082cb9b56d1e7b5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_wcf-m_svc_mon_sup_dll_31bf3856ad364e35_10.0.19200.110_none_756ba0685b6c3f32\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_13bf1fa5428ecea3\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_6d4be35dd691e117\AppxBlockMap.xml a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..simple-provider-dll_31bf3856ad364e35_10.0.19041.1_none_75822d5664503324\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_de-de_41161d725fa2f3e8\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..actor-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_10cf6bfb1f1649af\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon_31bf3856ad364e35_10.0.19041.746_none_b3fb9363317a2a00\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.collections.specialized_b03f5f7f11d50a3a_4.0.15805.0_none_b43fcbc749b1c2c8\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecenter_31bf3856ad364e35_10.0.19041.1_none_5e55c3519e6c0736\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..istory-ui.resources_31bf3856ad364e35_10.0.19041.1_it-it_4aa37109739610be\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.19041.1110_none_cab79e1fdc701903\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ndows-media-renewal_31bf3856ad364e35_10.0.19041.746_none_ddda8869e0386ac9\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netwew01.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2d2581d8ad3c0535\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..umservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_50ec65893e509426\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc_31bf3856ad364e35_10.0.19041.746_none_e872d1a617f9e73f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.web.entity.resources_b77a5c561934e089_4.0.15805.0_de-de_c5ee18a81338ec5d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_3dd0ac88661f7a76\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..aryauthfactor-winrt_31bf3856ad364e35_10.0.19041.746_none_c3e7f8c128e61833\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_10.0.19041.1_it-it_deb1aded688e56d5\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..ransformers-onecore_31bf3856ad364e35_10.0.19041.1220_none_3cfa7543f8571cf8\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..minkernel.resources_31bf3856ad364e35_10.0.19041.1_es-es_1f49b21079ed7a4c\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..stics-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_8329dfcb3b8a4a0d\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setproxycredential_31bf3856ad364e35_10.0.19041.746_none_48d5c44729238348\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_9dd2fd0bc68c998c\r\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmisdn.inf_31bf3856ad364e35_10.0.19041.1_none_973a63a76b82900f\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acproxy.resources_31bf3856ad364e35_10.0.19041.1_de-de_8482da5b9c4db3dd\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_lv-lv_8f8d90bfd69d5ea4\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..iders-msi.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6c9d4f1185db7613\ÄÅÁËÎÊÈÐÎÂÊÀ ÔÀÉËÎÂ.txt a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\ = "CRYPTED!" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE\ = "BPFYNFHUWPHNSDE" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe,0" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BPFYNFHUWPHNSDE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u08hwRO9h74aYk9.exe" a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LOCKFILE a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a47562ddb085ab39b821c1d8ab078edf_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630B
MD597d61dd38158163712ff1f93b02185dc
SHA1aeeff9e4e9c82b7093cb222e038c1a6fcfcf06a3
SHA25687c7671f844922e5d75372ff60271462c1f19105dce05c36a49bcbb6f93284d9
SHA51223b9a3da5c54e3528e79ef2529619e9a3828eb049baa59a0f67c6102179f134fcde03f30d8d36b2078e89fd6a28fc107a9c03814cd0ceb32e70495f36eb1655d
-
Filesize
332KB
MD5895af4be0eb4ece31d27f0aae016df7b
SHA13e5fc4beb752101678fa816741cbe0f9e8898838
SHA2562493ffad08febdd68fabfe82366491c2958fe424608ba7ce34d667fc991e2dc9
SHA5129926acc2416e0c1e7e21f10a22f29a414ee0033400f0ce27775741762d61e0ac70e7234f44e0ffd2e4cbbb2749a22fd25bc7beec4f3ecc63906a6856aae57186
-
Filesize
317B
MD55a0b4dd3d8f6fdf54103fd0001816f63
SHA1a988ebbe0d7c2c876680defbd253b1975457fc7d
SHA256f3f39acd473189ab9295d2dcf2e6197ba0ab850a82c4aa1ade5592ce1892c38a
SHA5126bd930896090b729ba992d21481c200cde2177a9dbcd5b7444356d694557f5ee518264f232fff6316fe6f824c1e107c54c330e3823e9f811a39e36f5c0b30d12
-
Filesize
21KB
MD582c6ac5e46c85206837e131eddfddd83
SHA1034737421748e5bfafd4e854534f3ad9fc9770c7
SHA25655cf8a93e707fb1962dcc46766d7c5f0f71b64f332a6117118f94d7cb95ff322
SHA512914b0c8f1d06e3b0b8c00bda75f227ed3864d048c2f69f0a331cbecef925ce68705afc53cdd041e430ccda931fd2605f5dc579ffe8beaa0acffdf4c51b162eb1
-
Filesize
8KB
MD5bbef149c3dcde06a394ba512422af3a9
SHA134b0e982f4d5d731de39b322d4824b6af6472627
SHA256f4097368dc6b67514f2991640d563bb52fc01c7fcda1c29566b9ed7208954cd2
SHA512595989ecf2d2bea0939dbf57faaa3bfb690166c17fb1d1da27b58871d54b3209d71c6e5489e983e5d6d3ad05fd97bf847a6e11bc9cbc9fcfc9535818b07e08be
-
Filesize
1KB
MD59ceb184e2a266d3bd7ee49d69f60c0b1
SHA185d584f08463901541033025c42cdc2d718f0bf6
SHA256b7e00794735ca81c2966cc03e93b5880504c98764ad9af3bd273c48c684218c5
SHA512f9f46dad610a9b033300c22a8373d30165cdfb3175800c4837232f98c6fbcc843b8666b6c3ae313931457b0576b1891cd3a2f9437aa68933d70d52a3751463b6
-
Filesize
49B
MD5bd6fc9ca96698344936b22ccef4ba428
SHA149fc5c771601ed5e3897908cf8b83b546821a6be
SHA2561003f1a53667e28e7952335498bdedd3377eae435189df01235b6602a5654823
SHA512095c01770b4f4e9f9fcb29c0ce290043f5c1de9c7b9767e7dd889aa25f3c103ac2dc8de5258a639aea477f649aaeb14687767a9912d6326503019369a1ed8ba6
-
Filesize
8KB
MD5546aaf9ef3bd5a5d57584730e8aa12da
SHA1009188fede09461fdeb7b7138bd47b4bce60a6c2
SHA256fdd0d7552e874aa61d24a097fd9c297616d4e0ef684906a17c8c9425bed52c00
SHA5125d6fd8a6332055afa3fcbc74a08638184bd322fc0d3da5180314438a6eb6e120b5d09c9fa0b89cea949a562522b16b9b7d49fa9a30438f0501a589c1d2f7bd2c
-
Filesize
62KB
MD5d63dfe04f005ed75846cf5e822057ae7
SHA1e4f817021c63e6c585358fcfca32a107a4abeedd
SHA256582a60a60390cd7b078c158226ca897b02274d0d826c8749b3a38b7b0ac7cd77
SHA512e421f18414950423704fea20e5cfc4f87e47f5182c76873050aa0e985bb9e867b36d0d8aac778a986aec71718f223c75183fb92aa12b6d300e67b1eb5775990f
