Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 22:01
Behavioral task
behavioral1
Sample
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
-
Size
23KB
-
MD5
cf3e607d693bea877fe1f9e6042bef4f
-
SHA1
d747a070e8200aec1d35e7dd4d87cc4df3f2eb7f
-
SHA256
d35438a10fe08f956f35ad90f1f2c37389d8d0426152816995978962911f4e4b
-
SHA512
8b93af12da1758280ec62b9d9095708af657bb8ca17b0918b4a0a642da1af340c2c5f2ed3b2da164b040e4bbbfd766d4c383c75377d1ff886496fd4698215ae6
-
SSDEEP
384:Sprr1gkDCgSH5BcSkn5nXbsTUvWcJwZsVXCoIy+80kQuR/eJC/Ni/N+yuB:IrVDCX+nFxOcJCnoQ8zQules/NMQ
Malware Config
Signatures
-
Detected Xorist Ransomware 5 IoCs
resource yara_rule behavioral1/memory/1504-4531-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/1504-4532-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/1504-4764-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/1504-4765-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral1/memory/1504-4768-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmbr004.inf_amd64_neutral_ccf1bc353e588fe1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-HK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_neutral_5cae6933bef20aa8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhay2.inf_amd64_neutral_ff250f861d941dd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_neutral_23613e3dd9401f10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr009.inf_amd64_neutral_2d7b3edfda95df40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_neutral_a64d66bac757464c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_neutral_547edd894d7c19d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcsto.inf_amd64_neutral_2d7208355536945e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1kx64.inf_amd64_neutral_1f62482fbb9e52a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_neutral_8e3809aa77440c37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_neutral_8eb7e6403ddbb7a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_neutral_82f4c743c8996d67\amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_neutral_09132735f1063a47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin004.inf_amd64_neutral_c8902ae660ab1360\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_amd64_neutral_0725c2806a159a9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_410e89ed86071c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nppcehhkmmpceemm.bmp" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1504-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1504-4531-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1504-4532-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1504-4764-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1504-4765-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1504-4768-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\cmm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Solitaire\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\System\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\FreeCell\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Mail\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\Media Renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1036\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-infocard.resources_31bf3856ad364e35_8.0.7600.16385_en-us_f255f15a35d061d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\system.workflow.activities.resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_image.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d1bfcbca480344ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-movie.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_23609c06f60a74cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rolspanel.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c71f9faad39c990d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmeiger.inf_31bf3856ad364e35_6.1.7600.16385_none_7f0b94a29fdc42f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-utilman.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5f5ad4d6e4612081\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_hpoa1so.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0bb844a9b2144e78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-winmeetb.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d691ba0dc1257515\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ieframe.resources_31bf3856ad364e35_8.0.7600.16385_de-de_01660f92b725d911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ad1c591dbc1da7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1c9f3fffd349960b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-s..ativehost.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ef353fcb61bba1c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..pp-client.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c5cb371e0d8c117f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..nttoolapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2b836fad8f8b06f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-icm-base.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7873d3c2eb59c6be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\inf\usbhub\0000\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_hdaudbus.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c7c43a447533c64b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_dbd1f9033ac6f371\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..licy-admin-scrptadm_31bf3856ad364e35_6.1.7601.17514_none_2f8f952e7b710a73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-artcon2.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_98b4ae4c6dcfba21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wwanui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_1084a5f1b421810a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_netfx35linq-system.data.entity.design_31bf3856ad364e35_6.1.7601.17514_none_8d4c9f9464beeeba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ncywizard.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0d053df5d2d7b64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d5fff42ae7dc1bc7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-remoteassistance-adm_31bf3856ad364e35_6.1.7600.16385_none_8a1854fb218af366\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c94ff0f7345728e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnnr004.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c7bed6f835b5846b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_machine.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2daccc45d1e19aa2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmaiwa4.inf_31bf3856ad364e35_6.1.7600.16385_none_0a4c2d2390747c7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_79208d13170f2c43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.web.dynamicdata.design.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dc43ff8c5e3bd681\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_faf66397e6b5f43f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-cscompmgd_b03f5f7f11d50a3a_6.1.7600.16385_none_22ace6a67fe3427a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-browser.resources_31bf3856ad364e35_6.1.7601.17514_en-us_290e0dd098f0a1dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-whhelper.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_40b9cc5d923e8dde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_es-es_170e1eebf76ef85b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.h..ocessor-driverclass_31bf3856ad364e35_6.1.7600.16385_none_559906a314d4f487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-com-complus-admin_31bf3856ad364e35_6.1.7600.16385_none_43b350887adefc43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-stobject.resources_31bf3856ad364e35_6.1.7601.17514_it-it_23fecc9a7307a249\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..texplorer.resources_31bf3856ad364e35_8.0.7600.16385_de-de_0b4ad5fbf69a59c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_es-es_52164c29ccb273ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-time-tool.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_095b0ba4a75ef07e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-mscordacwks_b03f5f7f11d50a3a_6.1.7601.17514_none_b7d09c4caf0b124a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..figurator.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1c8e5b1e7f02188d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-els-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fb678056a3c38e1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bbdfc73ce6b96d2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mes-chess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8cacdc64ccb58cef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0000040a_31bf3856ad364e35_6.1.7600.16385_none_62d518e4a49a5b7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0f099c9be715da86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ndservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d6ba5192c4554e2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-waitfor.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b9f064bd2afc10dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_0da0999141bd9bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d8fb88dcd7598a90\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-capisp-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_429833dbe5cc00fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_451fc49d021f96e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..onhandler.resources_31bf3856ad364e35_6.1.7600.16385_de-de_39111c993202d853\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..idebarres.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6df69fbc0a7897b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG\ = "NBLIWDNCXHILJFV" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe,0" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\ = "CRYPTED!" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395B
MD5cc34d0b040f41bc538903ad351ea6e66
SHA147ddae9973f9ffebf5320d86189f8bb24e38ede7
SHA2569bf248d49b9ddd35307457af659c1d9e42e9d926accbb93f9dd02ec14349bfbb
SHA512bbe66e13232b1905edf22deb14c8ea824fca45d49c75882a54f8798b68644505614af7bab29b0f6b27424e6acc218fd50fc4af836f1fee4d93ef41f0235776ed