Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
02-12-2024 06:42
Behavioral task
behavioral1
Sample
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
-
Size
14KB
-
MD5
b7516b479f88d9b9b5ad6a5293a4c0b0
-
SHA1
7bd26f1215bc64d6471adfd55c259493f17fc3b8
-
SHA256
00b36e7439c5d81198923d6ee2c5cfac0b4263280adeff9e266654a3c476955a
-
SHA512
b4189be8dd46e15f3e06f49d5bc7514123e33d44d7901cd1b14aa8aab35ba2166ae91814a0a8c7dd2edd25fd432613936380f1ea884e075f3f80ad9731cd46b3
-
SSDEEP
384:mprr1gkDCgSzXuBsrQMkEHm1aA+fKSWuKB:UrVDCSPh1atthC
Malware Config
Signatures
-
Detected Xorist Ransomware 4 IoCs
resource yara_rule behavioral1/memory/2128-4766-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/2128-4767-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/2128-4768-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/2128-4770-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\pcmcia.inf_amd64_neutral_1678e66e0cbb04b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WCN\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer-DRM-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_neutral_7617862a9cc286da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_neutral_23613e3dd9401f10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\bg-BG\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_neutral_a64d66bac757464c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\agp.inf_amd64_neutral_22cdceb61fbafb43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc11.inf_amd64_neutral_bb18e5f134c40c68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_neutral_232b95977cf6d84c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_neutral_5667cca434e3a6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_neutral_31d10a1a73b4feaa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_neutral_7a967d06d569b1e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_neutral_54f2470c084714e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-ndis\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_neutral_8b56291bfd2a4061\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_neutral_eb1d978f38f35bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\imekr8\dicts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\wdi\perftrack\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_neutral_6e65ea91a16f922a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netbvbda.inf_amd64_neutral_2bfa4ea57bd5d74a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky303.inf_amd64_ja-jp_b054bb0d59e0a3ad\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_neutral_330a593eb888237c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx003.inf_amd64_neutral_db618863f9347f9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-WMI-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2128-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2128-4766-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2128-4767-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2128-4768-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2128-4770-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Defender\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows NT\TableTextService\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-documents-performance_31bf3856ad364e35_6.1.7600.16385_none_3cdadc249cb267a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ntlanui2.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e560288e34f95bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_54bb94fdf5a91769\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnbr003.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_16c9bea073d666d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cdc890961bc0fbb5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-deskperf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_abe31ffb8f99dfbb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsFormsIntegration\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_hpoa1ss.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_861ee0b6fbd7dde8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9aaf9f8dffe919f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..layer-mls.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a96104734a0c6a1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..opeerpnrp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_839b02ed84198cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..rectplay8.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3880fee08332b130\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..s-mdac-simpdata_tlb_31bf3856ad364e35_6.1.7600.16385_none_e9b8547eaeba507c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-search-adm.resources_31bf3856ad364e35_7.0.7600.16385_en-us_73dd05ab43165ac9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..oledb-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_774f231c5b0ae344\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a6f41288d2f4c944\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ndservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_32d8ed167cb2bf62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\msil_comsvcconfig.resources_b03f5f7f11d50a3a_6.1.7601.17514_es-es_47128484920e98b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_703a658bb8025c25\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_netfx35linq-system...a.datasetextensions_31bf3856ad364e35_6.1.7601.17514_none_59288b04da432139\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-pifmgr_31bf3856ad364e35_6.1.7601.17514_none_b1707f244ce45eb8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..on0viewer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9ccc8358c385840b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\diagnostics\system\Networking\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..utoenroll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_16f7dbd4736deb32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..remote-provider-dll_31bf3856ad364e35_6.1.7601.17514_none_064a0b28b6145bf1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_scsidev.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6ad56145a211530a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wpf-winfxtargets_31bf3856ad364e35_6.1.7600.16385_none_252c8641bb943e1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.serviceprocess.resources_b03f5f7f11d50a3a_6.1.7600.16385_ja-jp_ef8a984ccd16191c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_mscorlib_b77a5c561934e089_6.1.7601.17514_none_9c12e14f7dfecaf8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..dlinehelp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4607ba621c6b5777\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7601.17514_de-de_513edc990604dfb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-msswch_31bf3856ad364e35_6.1.7600.16385_none_cef0c55401c324b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_acpi.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0fa7d070e2960b75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-eventlog.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_28cc097097c60a1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_33ec3c0b10770ea3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..rolpaneldisplay-adm_31bf3856ad364e35_6.1.7600.16385_none_c5fb78c4c8ecc851\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-basics.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_417f6f55559db4ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netbt.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4fb8acfa080f64d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_bth-user.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cccf6fafc7264ac7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w32time-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac517048b9a8287d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_39fac466966dd4f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..fcounters.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0d10273bbfe78c12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\msil_microsoft.powershel..anagement.resources_31bf3856ad364e35_6.1.7601.17514_es-es_4690ad2c7322309f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_ru-ru_a13dea73a92ad990\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_6.1.7600.16385_none_f60cc30a4a2fb068\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-peerdist.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ce1d87149358b81e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8d9526c50c4399e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7600.16385_none_3142c61b8ada510f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-certutil.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fec96b363ccb6fba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..lications.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c75de581a6dbdfaa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9eea396542b09367\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..nts-netsh.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d5547640d316675a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_f057b14af78fa0ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..nt-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e44bb9a9ea37ea81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-932_31bf3856ad364e35_6.1.7600.16385_none_ceb194d2fc8f5269\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wceisvista.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3b0908dad80413b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoviewer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_76444428a8bffc83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_6.1.7601.17514_zh-cn_70897adaf67ef72e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\ = "CRYPTED!" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe,0" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill\ = "EALOKZJCITOVLQN" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD59e42f042703a1218d6c240e86a10bce7
SHA1d93dfb855aa63b2fa1b925823bfd0916516bf0ff
SHA25645bd101248b2229f07b513f133793e875bb4c66b578e674300cc7ddced1ddfb3
SHA5120d0b0de68e23e9e3b34c74d2f32126cfff94c4b205a06522389953af0f9cff8f434f3623d4823ee78d07b6d60d0b6fe451918e715fce9fc81965ba42f0b3771d