Malware Analysis Report

2024-09-22 10:16

Sample ID 240408-d7y7fsff71
Target e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118
SHA256 0db2a40e9c1fa3349e1f7efc781878e676ad2dd75e3776280e2af2dc3ccd25e0
Tags
cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0db2a40e9c1fa3349e1f7efc781878e676ad2dd75e3776280e2af2dc3ccd25e0

Threat Level: Known bad

The file e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote persistence stealer trojan upx

Cybergate family

CyberGate, Rebhip

Modifies Installed Components in the registry

Adds policy Run key to start application

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-08 03:39

Signatures

Cybergate family

cybergate

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 03:39

Reported

2024-04-08 03:42

Platform

win7-20240221-en

Max time kernel

148s

Max time network

149s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\boot\\bootsys.exe Restart" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\boot\bootsys.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\boot\ C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Windows\SysWOW64\boot\bootsys.exe C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\boot\bootsys.exe C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\boot\bootsys.exe C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3004 wrote to memory of 1284 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\boot\bootsys.exe

"C:\Windows\system32\boot\bootsys.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1284-3-0x0000000002F70000-0x0000000002F71000-memory.dmp

memory/2848-248-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2848-267-0x00000000000C0000-0x00000000000C1000-memory.dmp

memory/2848-534-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 b76e4f51520ce8b6495cd6f52eb76c8c
SHA1 0e2025bb7f94115d14cb09f1c8c1521234bd2aad
SHA256 8d294e33a9b5be7698396dd6400388d4cee4612fb9de87cfb0fd346659e5f3e5
SHA512 3453db3a71a9eb69ac08f458d11f6d83d8d6665337b5f9f766cbc79432df8a7cf7932e717e9c64d96a82b339690ada542e807f4a9e1f85ecedb4512bee16ff0a

C:\Windows\SysWOW64\boot\bootsys.exe

MD5 e68e02368da1806c1f81b6325c7cd7e0
SHA1 0a076295e8185960c1ff1fdfe9300fa381c060a7
SHA256 0db2a40e9c1fa3349e1f7efc781878e676ad2dd75e3776280e2af2dc3ccd25e0
SHA512 60de2cc8483b6a4acb6c9822a4e8c13d9e4941b5fd85afd99281f448627b8aff07a70914cd20444e8d7177823424b8487262962fd646efa687b973e70ff9d97a

memory/1876-840-0x00000000240D0000-0x000000002412F000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2848-862-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 6af8cb46b6789716a9a75cba891439f4
SHA1 0d3373e511160b183b013eb26f91390ec4fad64c
SHA256 9a46d6bfa88b60f9f67af94b729a3ed2b51aec0d2af15fdf72abd40eead33434
SHA512 f7726e9a32a249d98951869492a0a07b363bb43a90b06fd7425c663d78b5172eb7fda6230d6e555f3a984a221c002d3fa0fe8723874e1a7b9d03ce180cb3fd16

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f7c3de927194db62fb6e7a9fcfbd97a9
SHA1 ebc81442ac1c9a034ddf323fd6e3c9d78c84c65b
SHA256 e3f5c5d2c4bad25eb0eeccfbfd69ae6a31ab7eb6569dedd5af71fdda9059acd0
SHA512 97f019f80648f9e0ab4126be9160438b25a878f9e1a4d1d94b972d12db9702e4abd3567d48f66b44acff1dc110ac0fbaf89613e0f5a9ad63e2e76bc79985bed1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 49cea04b47ff62af9c9745a4bcaf58cd
SHA1 d19c842858c89721197015903c186c881c313ed5
SHA256 97fb5078fa97bf8dce2eb2f90848c707656be5d5b923e11c8e198c64fb765422
SHA512 ae8f970fa7ac09716ac2fcca7dddda439e4889165f498c66bdc18d2bd0069b3293dac28827273b73f381338fd10e958679248f3796219dd5511a83bdaf30a8eb

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3ab3abf5a3d0f36d313722dbc8b4313a
SHA1 c6fffbdaf25c0ceb02cf0059ec358cf926ce6830
SHA256 e264c92f29a0c6e494c699aba9e4f8c5a8decc50ad2cb6a0735bbbe08b376741
SHA512 c339a0cd39af91fae6832e9bd5a8d2bccc34a90d30500e9ed2e3632ca882416b9ab21339ad6f78dfaee4f187e86327d2323496aa4eff256536d0d7a154bce42d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 50103e90c44876b781808d319d9bbe93
SHA1 864eec0837507753b270e92ef797acc2f5395fc4
SHA256 174483a15e54d8827ae70404ed26520c0449467a3d453a78a2466476c3946935
SHA512 4bfd56b9353028f272ef8c8e9eb541e309bc32c69fe30d732c292913a562ed641f9b2da6cecfcfdcaccd2a3d514c1499f11ced3ea4db88bea1bd61f381b95948

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 40e5039a2aecb85e1e3734c3998dcb10
SHA1 17d9ed53da248c735c8fb3460aa489d612853c61
SHA256 33fc5eb56430cba1af9a73ecab321d55a3ca747f7e9fb3687f7ff718edbe6592
SHA512 7b4c144a91ee2c9af37f1e73fcf6bef052af8b40ee7832eb80b5b72f4d518df118f5e7dc430bc4ae8ac4d1ac232c44972ddaf6121b16ade7bf6703a7e74942e2

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 8cf708c52197ddcc7fb506b795ad7bb4
SHA1 ff56ae5187c925294f9f615a2d640ee10ada3326
SHA256 3a0a355a21103011f1cbf3d9c8811b6080a6ad679931639ea6a31d1f807981ea
SHA512 a23ae535330d098704010003149b28b1896fb5b6a5488635491f30eca2ef83c7595247f74de68d1683f15b43b046629344d0071048c25fe90a4d3ea01052ab87

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b491e45658314ba86cd7db23e275d1de
SHA1 d884854e699c13f358a703f7a752acb2620b15f1
SHA256 eda92d3ae49a7d8af221e8910126b5f7752485caa7f97400a0a0391c4fda0ffc
SHA512 fe04654890b377dc85f4b6c049382c54b85e81cd8005ce2b4d3a21b5e13021b5e0589d9da8d247b6c4428efafeeae9f0bcd4c97a5daff79aa8999164137fe023

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 ec957de3e021e7a24af57995d8bd4982
SHA1 eff4842e7c21065e7497c7d3f17463439b4c5b26
SHA256 57f5fdf45bfb4e349b06177fe4e5aff04e978b7f72386b4ac99edd47b669d08e
SHA512 828d4b777ae38b23cf0edc746a66d3700bfdd672a72b49f8e6c1f8b229fd8d181b9e7a58eee369cb18ff87a2aa33d1dc49caf9d8e0e0a890b92f4725416feb0b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 ae0476b7a41a1e2e4c9bf64d2fbf1053
SHA1 d23c7818397f312bbc008c1ecb4290429cb6d06e
SHA256 0273a30d6045fa08c17e13366175e1afc33db71c240a3fc72303e3b5dea5bad7
SHA512 c58e196265f27040e637691ebcc10a5ac03e725497c5250aa5124fc82385868e4288df5faa8d7584a79558486a2560b02f7a5e9b7bc93fb56a2b426b36ebd98f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c4b22ce0845c7b59bcdb1a9ec7022471
SHA1 ac487414a243ff333bf792668176aaa1d1ed7359
SHA256 f587050934100cb25b0a3f0747bd5fa65f25bdfe5403e622a451abf01f955739
SHA512 d76548e99ee86db57d1f97915bacfa3e42e6d30d4f08ad8381fe9c8e996fa1851ce144a371155bf779d7e3fbf5a9db93c6289f25b6fc2502abeda61f0e7d8b19

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 0dea82aa5aa63201b949c8e813e26e03
SHA1 a6601e7955795c6b49b43fb84de824cd2f2e0331
SHA256 1ecb0864c87ca4ef5ab9db9f6a2fd337f4f566a4c93164b55693617b7fc18300
SHA512 afd9ccc6622d11569918fee859a289fe78433742ec069ea23c346005a364f26d130fc01bb7c6122e3c9527524634e9f7ea22e3e5fdadb530de319aa822c2b9f5

C:\Users\Admin\AppData\Local\Temp\UuU.uUu

MD5 eeeac66bcebcfe2eeba6d0f5ff90c42c
SHA1 3cf78071595308608e71991717892ec2b7e86684
SHA256 911b12dca688bd3654868d76794ac9c5e855febb2a66664eb858d4fbb95f6fdf
SHA512 936e2f9f73518de895e089d2b43ae4301a537130127f8da9ab311627013fa2ce5b797506ea8c38a991eaca613e884db3a70728efc3914099d00624c8fbc8256a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1e857f105b33dc7a11c82373d6ffd9f6
SHA1 90f95ee27ae93c3dbd69d102b3eb1aee26697e57
SHA256 b41eb34cd8f1abd6ccfebab660e5855a596be98ae5e23c294263f513fd1f4a06
SHA512 b88dea5d5538f865e6e3f4673784f079e7c1a55a307fdbc0f22df9e174d9ca8106a073e857e90e5f151d4cb21774b74b4ccfb1374048f2c56b95bc34accba1b6

memory/1876-1604-0x00000000240D0000-0x000000002412F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 764994de977cb5cecc8d2f4174c6ae2b
SHA1 9fc7550e36fc098b9683e38ded556c99b6d165ba
SHA256 18f3e6020db1beab1a32a5f096a630806aca528ef82b11efe6fca720674c57f3
SHA512 f8507e4b844ff42e6e0cbdfb94fa0f0d23ab8e35d63cf1b2c06e72091c4cd8ad8ad97650abe22b9477e65bb528096ed8ab0f31466a09d47a4e8df4f6ba89996c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d3157523c6f757e611bcaddf1e29f77f
SHA1 0c24f5a74f7c6aa16fb23681c691c7c825fcedab
SHA256 674641da0127172d9bb299a9bf07f5e30ee8ca651993680c864eb0bc08b900f2
SHA512 e3921d9e9747d3156f58ccc786957046ea30745dda31a9ecba4aaa655ad4360b842b553deeed1272dca810dbd939115c5c8f296a88cee2c7b17f072555be7a86

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 8ba3d9ad8b478a3a3c20769ce6284bb5
SHA1 63d44de061fb6363ac788f7a98b17e53ff28dc38
SHA256 c7bbf7b9938bf272f6e9fd01ab74169e9a5f90f6ae34b324164d39d7108b461a
SHA512 3e976cf1f0edf224a8188001420e31ec76e55ed62cd3fd520cc51ee8da53836f9bafc4eecee28823f7d1649948e0d6f25634db3f1c9b6c0bdeb0f19b0ddb1127

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 36d741f083cc5355c2f97282071eafde
SHA1 971992feccdbb5dea1cf8feaf6f07ba198eea237
SHA256 128365b476f8056aaa0c9ff879b48d421a7e9579dd4e6fecd955860006facdb6
SHA512 86ace049025fcb0763b8b9ab745778b4f15d3db8c65e89435a1058d44dd0544e5e10394f9cbb68a9803b90050b2a9994e5a49c0358e840b7eb803b2ed6cf19cd

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 03:39

Reported

2024-04-08 03:42

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\boot\\bootsys.exe Restart" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CG08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\boot\bootsys.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\boot\\bootsys.exe" C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\boot\bootsys.exe C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\boot\bootsys.exe C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\boot\bootsys.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\boot\ C:\Windows\SysWOW64\explorer.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\boot\bootsys.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2284 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e68e02368da1806c1f81b6325c7cd7e0_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\boot\bootsys.exe

"C:\Windows\system32\boot\bootsys.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4660 -ip 4660

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 564

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 20.231.121.79:80 tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2284-3-0x0000000024010000-0x000000002406F000-memory.dmp

memory/4380-7-0x00000000008B0000-0x00000000008B1000-memory.dmp

memory/4380-8-0x0000000000970000-0x0000000000971000-memory.dmp

memory/2284-63-0x0000000024070000-0x00000000240CF000-memory.dmp

memory/4380-66-0x0000000003460000-0x0000000003461000-memory.dmp

memory/4380-67-0x0000000024070000-0x00000000240CF000-memory.dmp

memory/4380-68-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Windows\SysWOW64\boot\bootsys.exe

MD5 e68e02368da1806c1f81b6325c7cd7e0
SHA1 0a076295e8185960c1ff1fdfe9300fa381c060a7
SHA256 0db2a40e9c1fa3349e1f7efc781878e676ad2dd75e3776280e2af2dc3ccd25e0
SHA512 60de2cc8483b6a4acb6c9822a4e8c13d9e4941b5fd85afd99281f448627b8aff07a70914cd20444e8d7177823424b8487262962fd646efa687b973e70ff9d97a

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 b76e4f51520ce8b6495cd6f52eb76c8c
SHA1 0e2025bb7f94115d14cb09f1c8c1521234bd2aad
SHA256 8d294e33a9b5be7698396dd6400388d4cee4612fb9de87cfb0fd346659e5f3e5
SHA512 3453db3a71a9eb69ac08f458d11f6d83d8d6665337b5f9f766cbc79432df8a7cf7932e717e9c64d96a82b339690ada542e807f4a9e1f85ecedb4512bee16ff0a

memory/4472-133-0x00000000240D0000-0x000000002412F000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/4380-157-0x0000000024070000-0x00000000240CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 49cea04b47ff62af9c9745a4bcaf58cd
SHA1 d19c842858c89721197015903c186c881c313ed5
SHA256 97fb5078fa97bf8dce2eb2f90848c707656be5d5b923e11c8e198c64fb765422
SHA512 ae8f970fa7ac09716ac2fcca7dddda439e4889165f498c66bdc18d2bd0069b3293dac28827273b73f381338fd10e958679248f3796219dd5511a83bdaf30a8eb

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3ab3abf5a3d0f36d313722dbc8b4313a
SHA1 c6fffbdaf25c0ceb02cf0059ec358cf926ce6830
SHA256 e264c92f29a0c6e494c699aba9e4f8c5a8decc50ad2cb6a0735bbbe08b376741
SHA512 c339a0cd39af91fae6832e9bd5a8d2bccc34a90d30500e9ed2e3632ca882416b9ab21339ad6f78dfaee4f187e86327d2323496aa4eff256536d0d7a154bce42d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 50103e90c44876b781808d319d9bbe93
SHA1 864eec0837507753b270e92ef797acc2f5395fc4
SHA256 174483a15e54d8827ae70404ed26520c0449467a3d453a78a2466476c3946935
SHA512 4bfd56b9353028f272ef8c8e9eb541e309bc32c69fe30d732c292913a562ed641f9b2da6cecfcfdcaccd2a3d514c1499f11ced3ea4db88bea1bd61f381b95948

memory/4472-393-0x00000000240D0000-0x000000002412F000-memory.dmp