Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2024 22:01
Behavioral task
behavioral1
Sample
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
-
Size
23KB
-
MD5
cf3e607d693bea877fe1f9e6042bef4f
-
SHA1
d747a070e8200aec1d35e7dd4d87cc4df3f2eb7f
-
SHA256
d35438a10fe08f956f35ad90f1f2c37389d8d0426152816995978962911f4e4b
-
SHA512
8b93af12da1758280ec62b9d9095708af657bb8ca17b0918b4a0a642da1af340c2c5f2ed3b2da164b040e4bbbfd766d4c383c75377d1ff886496fd4698215ae6
-
SSDEEP
384:Sprr1gkDCgSH5BcSkn5nXbsTUvWcJwZsVXCoIy+80kQuR/eJC/Ni/N+yuB:IrVDCX+nFxOcJCnoQ8zQules/NMQ
Malware Config
Signatures
-
Detected Xorist Ransomware 7 IoCs
resource yara_rule behavioral2/memory/2100-3795-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-3797-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-6960-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-6961-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-6962-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-6963-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist behavioral2/memory/2100-6965-0x0000000000400000-0x0000000000410000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Xorist family
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmomrn3.inf_amd64_c2314613ba3f3585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_e1022e6b4f7ab56d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_0406b31e81bea0d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_6550f790ed88c7ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_swdevice.inf_amd64_12050f4158021fcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Msdtc\Trace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvid.inf_amd64_7c50642b144b870d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sss.inf_amd64_503a2398f4c86893\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_ce438b6e0c5b1af2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ksfilter.inf_amd64_d5c8b2a031c7d5c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_b2ebe9229789b181\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\networklist\icons\StockIcons\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetConnection\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSScheduledJob\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_c20a3bb7ac1cd207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\halextintclpiodma.inf_amd64_7f59f2c73a7fab14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mvumis.inf_amd64_f0f4d0c799bb854a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_05ca2a1836c16cab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\filnnaccfiiknacc.bmp" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2100-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-3795-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-3797-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-6960-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-6961-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-6962-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-6963-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2100-6965-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\skins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Mail\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fi-FI\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..c-keyenum.resources_31bf3856ad364e35_10.0.19041.1_de-de_7a4bcc820bbff693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_product-onecore__c_sensor.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_b09d7854e6987525\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mp4sdecd_31bf3856ad364e35_10.0.19041.450_none_f72586590066c4e8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventaggregation_31bf3856ad364e35_10.0.19041.1151_none_2286a062d24d0104\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ko-kr_337ec84c18eb5c0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_f0aa60ae9c531752\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5fdd841c6398619a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packager.resources_31bf3856ad364e35_10.0.19041.1_it-it_27f63217004f32fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemcpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_46e844a7bb1ad02a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sframework-mscandui_31bf3856ad364e35_10.0.19041.1_none_409188a97eb917ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uxtheme.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fae15520a349674e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.19041.1266_none_b4e7c7cc9619d66f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-authmanager-component_31bf3856ad364e35_10.0.19041.789_none_2777a97bb9a05cd3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_wstorflt.inf_31bf3856ad364e35_10.0.19041.1_none_40c2629eb0704474\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..erecovery.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_aedbde1856e97921\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-npfs_31bf3856ad364e35_10.0.19041.1_none_5c629260bc48b98a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..revention.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_bf65f515c479260f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vault_31bf3856ad364e35_10.0.19041.746_none_cf625b8399d85416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-pickerplatform_31bf3856ad364e35_10.0.19041.746_none_f93b9d4d8a004255\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0002083b_31bf3856ad364e35_10.0.19041.1_none_038300d10f1ccc88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.IO.Log.Resources\3.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_it-it_0795fa7ac094725e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ngconsole.resources_31bf3856ad364e35_10.0.19041.1_en-us_32442ece44ba6f89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-accessibilitycpl_31bf3856ad364e35_10.0.19041.423_none_41be4f39e6fe1bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_wpf-uiautomationtypes_31bf3856ad364e35_10.0.19041.1_none_b6e4936d81f0a1b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-http_31bf3856ad364e35_10.0.19041.1_none_62b209ccb8387393\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040a_31bf3856ad364e35_10.0.19041.1_none_b27c8a6ef5e61955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000449_31bf3856ad364e35_10.0.19041.1_none_a0bf101f014dcac1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_412ceba6e304397c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_srpuxsnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_dfac788f0b5f0f3e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rics-storageadapter_31bf3856ad364e35_10.0.19041.1_none_8c975b23f4b95648\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cryptuiwizard-dll_31bf3856ad364e35_10.0.19041.804_none_a39946334bc3ad6f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cryptxml_31bf3856ad364e35_10.0.19041.1_none_0f4727a87daf83f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Drawing.Resources\2.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..re-client.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_693d3333c16d8ab8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig.resources_31bf3856ad364e35_10.0.19041.1_en-us_7ad566f862dced56\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ce-modern.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_15c23c1be3653257\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ayer-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1291c33272a63382\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..allconfig-installer_31bf3856ad364e35_10.0.19041.1_none_cd1a3bc29e2594be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-heatcore_31bf3856ad364e35_10.0.19041.746_none_c56105f0f16631ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_pcmcia.inf_31bf3856ad364e35_10.0.19041.1_none_20dbd05485d86c14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.19041.1_en-us_e195cac236039fdd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..rdefaults.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_95e670aeb809279b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_fr-fr_6de3ffe5662417e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.19041.1_en-us_03b55cc5252496f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-id-connecte..nt-provider-activex_31bf3856ad364e35_10.0.19041.746_none_4926a58270d1f048\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wnetvsc_vfpp.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_936a0124c32d740b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_xusb22.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_097f88cfef7c49e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ccess-userdatautils_31bf3856ad364e35_10.0.19041.1081_none_5e285fea8a8cdff9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\v4.0_3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ovedevice.resources_31bf3856ad364e35_10.0.19041.1_en-us_76bcbd669813aeeb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vault_31bf3856ad364e35_10.0.19041.264_none_cf4ab19999ea6787\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onecoreuap-rastls_31bf3856ad364e35_10.0.19041.1_none_ee7512b3aea5bb3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\v4.0_10.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG\ = "NBLIWDNCXHILJFV" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\ = "CRYPTED!" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe,0" cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf3e607d693bea877fe1f9e6042bef4f_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395B
MD5cc34d0b040f41bc538903ad351ea6e66
SHA147ddae9973f9ffebf5320d86189f8bb24e38ede7
SHA2569bf248d49b9ddd35307457af659c1d9e42e9d926accbb93f9dd02ec14349bfbb
SHA512bbe66e13232b1905edf22deb14c8ea824fca45d49c75882a54f8798b68644505614af7bab29b0f6b27424e6acc218fd50fc4af836f1fee4d93ef41f0235776ed