Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/12/2024, 06:22
Behavioral task
behavioral1
Sample
f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe
-
Size
12KB
-
MD5
f7b6f1df60e645ba475349da94127061
-
SHA1
23ee2a41565755d11f817ff78f36c15484cd39ed
-
SHA256
5dd845c0861818ed3aa58f35ce4d3d011321d55416760164a92b130a491ccbdb
-
SHA512
c3e1563ec243e4e338e49236451eb5cde5547b0a6fe667a7b78394576ddb01b7024d93e697c51b2a6b50e792cbbb61612b5fb6d2aa14d8a5998edf1375004157
-
SSDEEP
192:y/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMhN:yebFNw4Pk1itKkpAjjI2Ypdmh
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmarn.inf_amd64_neutral_fa693d8797766f49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_neutral_f62ac4bd04e653d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtx64.inf_amd64_neutral_410e89ed86071c9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\SQM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_neutral_d7bf942e99bb1d41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\sk-SK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_neutral_e204d4267d752eb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9b214cd9b78760aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wialx002.inf_amd64_neutral_71f4aacee1aa9f06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_neutral_34624840c3163a38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky302.inf_amd64_ja-jp_dd74fe49601b74f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiabr006.inf_amd64_neutral_0232ca4f23224d01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_neutral_10ce25bbc5a9cc43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\he-IL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\faxcn002.inf_amd64_neutral_3d392ccc357e04db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_neutral_1cb648411f252d13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_neutral_6611a858035bf482\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00v.inf_amd64_neutral_86ff307c66080d00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnin004.inf_amd64_neutral_c8902ae660ab1360\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnr002.inf_amd64_neutral_37896c5e81c8d488\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas2.inf_amd64_neutral_e12a5c4cfbe49204\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\spp\tokens\ppdlic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Common Files\System\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Journal\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\Office14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Portable Devices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\7-Zip\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\wow64_microsoft-windows-terminalmanager_31bf3856ad364e35_6.1.7601.17514_none_5ca32904edfb1c77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..ment-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f2e3a7801bd838f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-photo-image-codec_31bf3856ad364e35_7.1.7601.16492_none_925929542f2a2e65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..-provider.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_80ac76c21164a1e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-winmeetb.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4a4444b9f6d87dbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ls-ksetup.resources_31bf3856ad364e35_6.1.7600.16385_es-es_147df6421de0136e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnbr003.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7446ebbd80dd5ec9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_hpoa1ss.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2f0fb6afeab5e9ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d2d.resources_31bf3856ad364e35_7.1.7601.16492_pt-pt_e93415d358c6c7f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..nesweeper.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8d9bdecbd895566c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_subsystem-for-unix-..lications.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8a2303b71b4db415\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_mdmsier.inf_31bf3856ad364e35_6.1.7600.16385_none_feb63cafc6f86b25\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnpibs.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ae91626ac744a8a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.2.9600.16428_en-us_db95e4446c3d914d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-http-api.resources_31bf3856ad364e35_6.1.7600.16385_de-de_087677315d227b62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4a8cc9d85145473a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-securestartup-wmi_31bf3856ad364e35_6.1.7600.16385_none_bc7747799f002109\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smi-engine.resources_31bf3856ad364e35_6.1.7600.16385_es-es_dd7a263470982d71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..-inputdll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da0a2c9d1fd17fdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mes-chess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8cacdc64ccb58cef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\msil_microsoft.windows.d..is.sdhost.resources_31bf3856ad364e35_6.1.7601.17514_en-us_56bb5a7dc5566557\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d2df6e2aa172aab3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-t..ied-chinese-quanpin_31bf3856ad364e35_6.1.7600.16385_none_f79af98021986eab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.16385_none_8911d4b604a223a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l2na.resources_31bf3856ad364e35_6.1.7600.16385_es-es_020b6045f219803a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-propsys.resources_31bf3856ad364e35_7.0.7600.16385_es-es_6d0964040f51d983\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sonic-tables-2th0_31bf3856ad364e35_6.1.7600.16385_none_cbaf31ee7964426c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..nts-netsh.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d7105bb0279de449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime-log_31bf3856ad364e35_6.1.7600.16385_none_80e2cc3f48b55a8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wpdfs.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b6c8a09a1086f91b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7601.17514_es-es_845b441e1a006240\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_85f6c12b845befb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sysdm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1ed9c3fcc95f0507\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_security-malware-wi..-defender.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1c1b5d9267e50375\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..kitengine.resources_31bf3856ad364e35_8.0.7600.16385_it-it_8b52ff7475204d36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\60b93ce08d30a2fba087f8630a504cb8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wcf-m_svc_mod_end_perf_h_31bf3856ad364e35_6.1.7600.16385_none_819e8545cdbf46af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_3.5.7601.17514_es-es_2b9c034dfce2c478\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-scheduleui_31bf3856ad364e35_6.1.7600.16385_none_74990c26730e98ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..-netnwifi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_619eaa600101ed1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..ator-base.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_96845312c96b95ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_4802d78d4a814db3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_078760fa679d4aee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\618ab8996b43e841efdcfb273393fc02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_en-us_1973d5cff4368a50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_6.1.7601.17514_none_6dd5e8c3b6b81894\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-winsock-legacy_31bf3856ad364e35_6.1.7600.16385_none_e33b8ccc72da5441\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_netfx35cdf-system.servicemodel.web_31bf3856ad364e35_6.1.7601.17514_none_7ea1333680b38348\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Workflow.Com#\20e46d1d15a9eaee80b1d16dafef4017\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dfs-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d01b29b3f87f6f57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_54d62f663d777131\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1375979500f2c08b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.1.7601.17514_none_401c514f83c9df99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Device\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..container.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c68b602c2ebcbf68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-app3rd.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3ec96a92fca93d35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasapi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0fd60933e83a1fe7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..libraries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d63ded3632fdfecd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe File created C:\Windows\inf\usbhub\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe" f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZEDXTPPUGUDHYFG" f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\ = "CRYPTED!" f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open\command f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\shell\open f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZEDXTPPUGUDHYFG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IhZKoaBO46k4cxD.exe,0" f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f7b6f1df60e645ba475349da94127061_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD50f8f1bcb3bc186c96cc2650fe18652cc
SHA1390735204b42718da68e76c38716d76ac5fc64af
SHA256b6f08bae98a0d74b6fc972b3a646c444aeda602b48bc67aa83f048784e76b6f8
SHA512f150a2ac8ee1cd7f9d23d7ca68adc4478824691363e86a4a37e60156ebfee7b629ec5d0df454a1ae16cc788bcd0f1eb2d056a8afa8f5b018164b1b8f2bebccfe