Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 16:21
Behavioral task
behavioral1
Sample
ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe
-
Size
30KB
-
MD5
ec5ca5e4aafd66caa4a4c5458b765cf2
-
SHA1
492e3c7936aeed14b73735a9f34a3fc94730d755
-
SHA256
65fc86c4ce308b644af6121a6c505ebff7c7532770cd46f9cd9bd8fb391bfd51
-
SHA512
a82844f4a05fcdc5172604564e2948a7276dd6cb0c08b18e645430320596cd64f87371bae47ecd2d0849d30f177465b4c48f4b8741c1771c8cc0e90725af821c
-
SSDEEP
384:mebFNw4Pk1itKkpAjjI2YpdmCLv/0WrZFs+vKprIXUdKdeK2SC5Vfv:m0FmBkpKjPYp7vPr7s4Kpr2deK2Nb
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_neutral_be11b7aaa746e92d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\com\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-TapiSetup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\elxstor.inf_amd64_neutral_4263942b9dfe9077\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_neutral_e5ca2f01ca47bddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_neutral_eb1d978f38f35bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nfrd960.inf_amd64_neutral_cfc8c0013e9ede68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\agp.inf_amd64_neutral_22cdceb61fbafb43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnfx002.inf_amd64_neutral_b6dd354531184f64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_neutral_4ab014d645098f5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\data\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_neutral_6fd673519d66ab20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_neutral_fbc4a14a6a13d0c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WCN\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\memory.inf_amd64_neutral_c2d2c213c3138487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Msdtc\Trace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\adp94xx.inf_amd64_neutral_4928c8870f6a1577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\faxca003.inf_amd64_neutral_5b8c7c1dda79bef4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_neutral_4ca64d28e1be8fa9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jloaddgilloaadfi.bmp" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Defender\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EURO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\lua\http\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Journal\Templates\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_de_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_c6ff5262e5f5bccc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad9d54b923c3da85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-wmpdui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a84306473c671bb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\Speech\Engines\Lexicon\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_en-us_1051f5dad299e574\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-windowsupdateclient-ui_31bf3856ad364e35_7.5.7601.17514_none_9ce1375a66515376\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wiabr00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8e25d876d586609d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000425_31bf3856ad364e35_6.1.7600.16385_none_4f51af6cb125c78a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_63b6217afda37853\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.Service#\1e96bc85441d7719ea6f7e63c4c3e287\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-helpplc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1a757bbb5bc97acd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..workspace.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9bb0cde6683692ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnrc00b.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0b8954d473aff991\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-directwrite_31bf3856ad364e35_6.1.7601.17514_none_d4a4d90d5db128bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnbr00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9f03a13cf3f79c4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\inf\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7d1934d0258df2c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ic-module.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e84325a814020a94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netapi32_31bf3856ad364e35_6.1.7601.17514_none_eb5a2082182f6873\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8a8c4b4f060507fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_sk-sk_a6fad1d3f5b2f99e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ntfs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_40a72e2477e646bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6a776e2d9017e651\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..smcnative.resources_31bf3856ad364e35_6.1.7600.16385_en-us_912e40bbd6ff2a08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a4d549a5b0a13e77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4d4c460d5327b1f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-jet-ji32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_546aa6ff82be143e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_6.1.7600.16385_es-es_25b6a9ab388a09ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..cyscripts.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a2f2b00be16607c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mydocs.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c7be3b23289de62f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..framework.resources_31bf3856ad364e35_6.1.7600.16385_en-us_47a7e66e1fa4bb1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-v..re-codecs.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_860ada97f71e496c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-scripting.resources_31bf3856ad364e35_6.1.7600.16385_it-it_17adc05c82f22992\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_ehstorpwddrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b56a91c5867bed1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_29821f18f334f732\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnrc006.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9045389da781d260\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..e-apphelp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_85bfe66ff35583fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_6.1.7600.16385_es-es_43be31b1243492e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-v..eocontrol.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1e4cbc67ccce19ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0c185df0b16438eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_es-es_103af8cc43d0a688\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..ore-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eb3ee165f49968b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_en-us_f04371ec21c4626e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\msil_system.data.services.resources_b77a5c561934e089_6.1.7601.17514_ja-jp_979849783af93a71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\ISymWrapper\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e89908d79afacf17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_netfx-mscordbc_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_414c2fe8825bd6cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_75107e8ff0ade521\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\msil_policy.6.0.microsoft.mediacenter.ui_31bf3856ad364e35_6.1.7600.16385_none_a7bcb998fb9801a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-csrss.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31768b4153e628b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..oradapter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bf9af86f3ce6a687\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..mponents-jetintlerr_31bf3856ad364e35_6.1.7600.16385_none_0f472a3521bdcfd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv14259fd9#\a0401c16e342af1d26406c93706acb15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_3c1b29463bcb5626\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f4c280f4fcec33c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..k-msctfui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_151b6ff191ba8508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-robocopy.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b4a1152b51c216d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Iden1fe87377#\2a8d6efe5a99d9e6b03587df841c2087\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_flpydisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6fc48f291b96237b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG\ = "NBLIWDNCXHILJFV" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe,0" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hYcsG ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\ = "CRYPTED!" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NBLIWDNCXHILJFV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0Da3N2xFp6Xv267.exe" ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec5ca5e4aafd66caa4a4c5458b765cf2_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395B
MD5cc34d0b040f41bc538903ad351ea6e66
SHA147ddae9973f9ffebf5320d86189f8bb24e38ede7
SHA2569bf248d49b9ddd35307457af659c1d9e42e9d926accbb93f9dd02ec14349bfbb
SHA512bbe66e13232b1905edf22deb14c8ea824fca45d49c75882a54f8798b68644505614af7bab29b0f6b27424e6acc218fd50fc4af836f1fee4d93ef41f0235776ed