Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 06:42
Behavioral task
behavioral1
Sample
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
-
Size
14KB
-
MD5
b7516b479f88d9b9b5ad6a5293a4c0b0
-
SHA1
7bd26f1215bc64d6471adfd55c259493f17fc3b8
-
SHA256
00b36e7439c5d81198923d6ee2c5cfac0b4263280adeff9e266654a3c476955a
-
SHA512
b4189be8dd46e15f3e06f49d5bc7514123e33d44d7901cd1b14aa8aab35ba2166ae91814a0a8c7dd2edd25fd432613936380f1ea884e075f3f80ad9731cd46b3
-
SSDEEP
384:mprr1gkDCgSzXuBsrQMkEHm1aA+fKSWuKB:UrVDCSPh1atthC
Malware Config
Signatures
-
Detected Xorist Ransomware 7 IoCs
resource yara_rule behavioral2/memory/728-3858-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-3860-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-6965-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-6966-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-6967-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-6968-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/728-6969-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\c_sdhost.inf_amd64_b71f983cb35bfde3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-PT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_netdriver.inf_amd64_2d569d832b41b8df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_4db9ca877f67dd36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmvdot.inf_amd64_04863374c9db2052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bthprops\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iastorav.inf_amd64_87f761c07c99d5e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_20ad4886826af1d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_95e01117eb9c1bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_a6da30fe583368a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_9fac168e1cbea90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_0c5757ecd1574b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_infrared.inf_amd64_3160910a003e1f11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_bc07e137c52c529a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_b6cb67052996a0bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_ucm.inf_amd64_c30468a947db0fa8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_f9b71b1d9c8643e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/728-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-3858-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-3860-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-6965-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-6966-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-6967-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-6968-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/728-6969-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\Simple\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ar-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Services\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-i..rolviewer.resources_31bf3856ad364e35_11.0.19041.1_es-es_9676a876fb5d122e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-applicationmodel-core-winrt_31bf3856ad364e35_10.0.19041.746_none_93dc68edc428ac32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.build.utilities.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_46121d19d4e92b51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..cess-poom.resources_31bf3856ad364e35_10.0.19041.1_it-it_c6ad66ca42443af4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wsp-health.resources_31bf3856ad364e35_10.0.19041.1_de-de_a23fb9132ab51008\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..p-raschap.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f19778ed77062c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres_31bf3856ad364e35_10.0.19041.1_none_321a321236e44693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe.resources_31bf3856ad364e35_10.0.19041.1_en-us_5e4b43a9a22bb04c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..n-library.resources_31bf3856ad364e35_10.0.19041.1_en-us_c9d199a5798fb9c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_multipoint-wmsstatustab.resources_31bf3856ad364e35_10.0.19041.1_it-it_18f91af06ad4ab97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.19041.1266_none_d615a46735302b29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_10.0.19041.1_es-es_a753cd1aa75c026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..-brightnessoverride_31bf3856ad364e35_10.0.19041.746_none_6efacde02c8ff6d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..re-security-webauth_31bf3856ad364e35_10.0.19041.264_none_4014104f46c9a846\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040a_31bf3856ad364e35_10.0.19041.1_none_b27c8a6ef5e61955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photobase_31bf3856ad364e35_10.0.19041.1_none_f67180963a5bde5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_10.0.19041.207_en-us_034a758b1fbf3096\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tbs_31bf3856ad364e35_10.0.19041.1_none_a4a8e27917b1d4a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netr28ux.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_af4c8003ca6f5c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_vstxraid.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_37eff9fd5fd3b8b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..llmanageretw-events_31bf3856ad364e35_10.0.19041.1_none_38d9e41fcaebe0b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-editions-professional_31bf3856ad364e35_10.0.19041.264_none_ba5e4a287945a683\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p9np_31bf3856ad364e35_10.0.19041.1_none_6a6acb72ee41fd01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_nl-nl_cc1a553810af34e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-signalmanager_31bf3856ad364e35_10.0.19041.264_none_bcf75b4aec20c233\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..tallation.resources_31bf3856ad364e35_10.0.19041.1_es-es_603f255ef6a960c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c_smrvolume.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b60e3a80ba205656\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_3d6afb403e8c5716\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wdmaudio.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_40f80d1e0ba170b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setup-cleanup-task_31bf3856ad364e35_10.0.19041.1_none_02f8a5eb170588ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft.internati..ngs.commands.module_31bf3856ad364e35_10.0.19041.1_none_b8df611185daa388\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..appvprogrammability_31bf3856ad364e35_10.0.19041.746_none_ca08a5430d378c28\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verydrive.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c6fa5a079e49d943\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_10.0.19041.1_es-es_2d6bea4400ef996a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ne-client-overrides_31bf3856ad364e35_10.0.19041.1052_none_a74b8f64d78e3b2f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_de-de_2e2190de958d3233\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.19041.264_none_0b9a2e5cdd119cfc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_mmcss.resources_31bf3856ad364e35_10.0.19041.1_es-es_6386d2f6d6c7ceff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cryptowinrt-dll_31bf3856ad364e35_10.0.19041.1_none_0d023d79ef1370ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..notificationmanager_31bf3856ad364e35_10.0.19041.746_none_afe69a9ffef04964\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mprovider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_0c5b3a30ad8ffaee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onex_31bf3856ad364e35_10.0.19041.928_none_8e30b543b0799c2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddoiproxy_31bf3856ad364e35_10.0.19041.1_none_f55a05389d7236c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..xperience.resources_31bf3856ad364e35_10.0.19041.1_en-us_207ebb127a39169b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-base_31bf3856ad364e35_10.0.19041.264_none_00a98b36e844917b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_10.0.19041.546_none_964c9e068c1b0905\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.activities.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_5713e1bf0cdca2f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_ipoib6x.inf_31bf3856ad364e35_10.0.19041.1_none_7dbd8ed970010e0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..c-drivermanager-dll_31bf3856ad364e35_10.0.19041.1_none_c623bfbd8956aa49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfvdsp_31bf3856ad364e35_10.0.19041.746_none_e20a9893e49df51e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..henticationbinaries_31bf3856ad364e35_10.0.19041.1_none_f5f4f51cfb3d0189\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..ncontroller-library_31bf3856ad364e35_10.0.19041.264_none_90ba872b37ccf2cd\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..y-spp-wmi.resources_31bf3856ad364e35_10.0.19041.1_it-it_282cacc1c85f50a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..2provider.resources_31bf3856ad364e35_10.0.19041.1_de-de_fcc8fb29ba9929f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ion-winrt.resources_31bf3856ad364e35_10.0.19041.1_it-it_8c1f45ace55f13f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.19041.1_de-de_08589c9287cf20ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\diagnostics\system\IESecurity\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1_none_f725ad3465e95fe3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe,0" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YBZ5IRlP141LS01.exe" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vdbkill\ = "EALOKZJCITOVLQN" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\ = "CRYPTED!" b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EALOKZJCITOVLQN\shell b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7516b479f88d9b9b5ad6a5293a4c0b0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21B
MD59e42f042703a1218d6c240e86a10bce7
SHA1d93dfb855aa63b2fa1b925823bfd0916516bf0ff
SHA25645bd101248b2229f07b513f133793e875bb4c66b578e674300cc7ddced1ddfb3
SHA5120d0b0de68e23e9e3b34c74d2f32126cfff94c4b205a06522389953af0f9cff8f434f3623d4823ee78d07b6d60d0b6fe451918e715fce9fc81965ba42f0b3771d