Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe
- Size 288KB
- Sample261002-kssvfsec94
- SHA256 cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af
- MD5 430bbe6c3fd3adeb6d90869823e852fd
- SHA1 075620d92d5a15756b9d1b41d4268d12c69d4f15
- SHA512 ffa2c2c828dea8d01c34cdf042db802453ff8cab45c7b35bd887a1150c11e578d25fa811089885594cf728f39a8487fc384f722bc87e440c240599f95c544f86
- SSDEEP 6144:8jMKITkBXkHt+PfGSwazjcHFQemvegHwDc2wtqSYrn:b+PfGSwCjcSVveDakrn
- TLSH T188547B22B2C58077E2431970E879773592F9FE750F254BCB6284FB0DA8746E3983A356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\PkgMgr.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\autochk.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\cttune.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\sfc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\sudo.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\winrm.cmd jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\winrshost.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\wscript.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\certreq.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\cliconfg.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\doskey.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\WWAHost.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\ddodiag.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\mavinject.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\rasautou.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\sethc.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\attrib.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\auditpol.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\clip.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\dpapimig.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\RpcPing.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\stordiag.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\w32tm.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\cmstp.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\DpiScaling.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\ipconfig.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\net.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\diskperf.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\msfeedssync.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\rasdial.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\regini.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\proquota.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\regedit.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\shrpubw.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\dfrgui.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\LaunchTM.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\mmc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\more.com- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\regedt32.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\svchost.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\appidtel.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\ARP.EXE- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\colorcpl.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\cscript.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\fontview.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\mshta.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Windows Defender\MpDlpService.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.26100.1150_none_f64f3a9ea7a6b9a1\WMSvc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_6a91f0bc88e36d4b\Register-CimProvider.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\pcalua.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\rekeywiz.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\ielowutil.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\r\OptionalFeatures.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\r\imjpuexc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\DataExchangeHost.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\userinit.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_04bcf928bfc9ab50\jsc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_492d9960807b3cd6\ipconfig.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpconfig.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\showmount.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\msil_c2wtshost_31bf3856ad364e35_10.0.26100.1_none_bb66eed9eb812fac\c2wtshost.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\r\adamsync.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\r\nltest.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmstp.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1_none_7f9f7003cc70f4b2\regsvr32.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_18d76879146fa99e\TabTip32.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1150_none_24e2f2e0c4c87239\r\wimserv.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\r\vmcompute.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\r\SystemSettingsRemoveDevice.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_ae4be759a24c5f51\odbcconf.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1_none_eb822b3ce383f6d7\dialer.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.26100.1_none_a74fce2d41576c14\ilasm.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\edpnotify.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_08f23f1b0a87acee\getmac.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\SysResetErr.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_f6d6d78e8be62381\wlanext.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\aspnetca.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cca62fbaa5cbe2bd31681da1e964b9484ce2ad5eb881936271f8a1ea4a1331af.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.2MB
- SHA256 de71a7968b8416c786ad8c88f25e9641aab3e37ea9f433af8d7d80d493fed8be
- MD5 83e516ddbbf7455ebb236f92d16a5280
- SHA1 d89a9946a29712c40772f5fe189e4ec66d428514
- SHA512 5b7d8a528910c0e284645e56eb08df6255bf58991c09619c72d7df9a64865bedb6a4127f9e19097b9f7717f451e6266f1ba6a5931c6b3710adefcc1f250dbd52
- SSDEEP 24576:b4GS3beDa2xa7/ezSC6vUyD/aqgrvWx6q8wyuA:b4GHDq/ezSC6vUzPvMHjy3
- TLSH T1DA55F915F5788333D0B2D0B9C5D6AAAAFE7234464B3089CB0246D76C3E376E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH