Malware Analysis Report

2024-09-22 10:41

Sample ID 240410-h8tqksah4s
Target ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118
SHA256 4f4bbd221400dfda9212f322c02953131d9fc3be871d5cc6b66a9b7d36e9ca26
Tags
cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f4bbd221400dfda9212f322c02953131d9fc3be871d5cc6b66a9b7d36e9ca26

Threat Level: Known bad

The file ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Modifies Installed Components in the registry

Loads dropped DLL

Checks computer location settings

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-10 07:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-10 07:24

Reported

2024-04-10 07:27

Platform

win7-20240221-en

Max time kernel

148s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT} C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2808 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2808 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2808 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2808 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2220 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe

"C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2808-8-0x00000000021F0000-0x0000000002270000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 e897e941392b15de8a01a848aa24b7c3
SHA1 7dea6923f980f921674648a9b1f0ff667bdcc223
SHA256 7e4176debfec3f1f3f0b3171c28c8a40eb20df242165e72abcb282f8656723d1
SHA512 2318a5e3c1310e129a877b6e801913a1b3b2ae8a9805bf7345236a62d5220f4272c1fd4e8e75fbd5f0f6a6025bdfa8867580f2757f7d1f3fc3435419dcb07687

memory/2808-3-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/2808-9-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

memory/1396-14-0x0000000002A40000-0x0000000002A41000-memory.dmp

memory/2720-259-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2720-261-0x0000000000170000-0x0000000000171000-memory.dmp

memory/2720-536-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 b05681d52dd61e255b735ded4d0bd155
SHA1 33bb64fae2d5e0b90c0341504e731d9f24d035f8
SHA256 3ac364f98ddb278debe624d2ae9dd3b83d0aef6e49a62db5a2ce43358571ce1f
SHA512 89f9c2bbe69e4471a701a8b0ad67113b84d7724d97d3edfee7f90f4e8e78318d4ab4cda5cbae54cbaa70bfe7edb29ce3de2bcf996d39c5afdcd0afdf5b1068d3

memory/1188-839-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe

MD5 64481ef51b2e4ef8b60ef509331c26e4
SHA1 64012a43b9f78509562ff587562b8c2f3764e545
SHA256 c18093af5bffdf7216cb897a712644d3960ed166ee48c9235eb9053d21714235
SHA512 47600ff236869efffffe5379afbcc757514039e4bd9961cd70c55f13a390e5a28e81a7db095baa0f6155fcda32ac7d400ac4f58de3091d21c486b5084d4f8013

memory/2720-873-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6275c3f079c6085e3dfbaa1151ac2e64
SHA1 a7370408ff3f2c4dfbfe462eade63022118ff798
SHA256 7049eba4eb5f80d7c63f414b2278444075e1577d519782e131048e1f5b722270
SHA512 6866911c664a8b93f284ea5f9fd26a6500f3c4c856149a0768e7febb489484757ddb1a8ad61cf1d471431d066fca611a5e86782f22f6de8a84a4e488d1ca8fc4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e05aadbbcb64304389e23a81a3249758
SHA1 823cebdef388c88489b5cf6585181fc590fda922
SHA256 48b4d27649282abc25a8030bfc291d1def6d31725a9da5dbd91b5aa12c079b2e
SHA512 0179b79fdf8f31959077cc0dfb5aef4a2f12a798ec9341b47435184d818d9d6b8453888fbcab2114dc0fa02082c2210a1d3519a0d0987678f925ab4476f1e45a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c3fa070645b4047a9e293ebb3dcaa252
SHA1 60d519d493cd3827ab8a0c35b9d9bd36db111d2a
SHA256 eb2907fbf189227b72887ca30ba3f8d08fa5ed2cfdd93db86cc0a4bd7bcb018f
SHA512 2f64e611eeaaecfc919993cbe64c81a82d55129ff4befacec47e892191364bbdc1eea104b7585f5ec5fc906b13ae67f421863f63f77122f582c62157e4ce8c73

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fb93a5cbe2c1cdd2a4942269d15684a1
SHA1 51463225775a7c04057a5f4f130f6ebf09d68de5
SHA256 2dbad7849e3860d9b1924786be3f0313b7a9876d7a28d903501817a087a836eb
SHA512 4fbba7cde652fac56e747b5aa5d93e61ad5f4ded341c9d1589a85c3ecf149e8d04d33b5d42d5c4ee3d0779ffbb7501152e23f9f824be2e97469349667160fe7d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5c0fa3141f730cc9df5b2817102eb7a4
SHA1 f988752105a39dbc190f853f37bb8a3fef2e202a
SHA256 4e173ab00eda6762a949adab5d6b4caa699c6777357fc870e7f2671cedd1ea05
SHA512 bad74ee5748fea222857c1a43e6a83c4ed290d0b8ec3a4364d02b54663ee20d78ecb210a41d6bb7d62dcf4ce161558ca12cb8403c98b6bf1e0251076c680efc2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 868bf8079f734cab4515025fc0d43904
SHA1 db210b2bfa971ec4417369ddac306462991c3344
SHA256 d5f1eb82e9383ac09944c3b9d82ff86f1d9a4ffd56232d436098652f5ac20b67
SHA512 1206dbb2bb982d955e78a2353d602411e3f40a4fe94988894b056cc531a6d8deb295ceb160407e98e776ec46128b7c7d39947b10fc0edb143d3d12039de7b6c6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d9f78af83bce63606d35fd791f4fc208
SHA1 06bacebfb6a6dbb94a9c1bef1df5d9715bf0f21d
SHA256 838ba387d7ab6cce5ea2a1c22d4aa8c21934cb8a75538d47d4f1d003dbb643ef
SHA512 e53b8d61332e3ff5410bff645f6d31bfa3952228fb8c0b4686553f51adc0e61be4409101d248395d35c626e6bc9626dbce7e67868a838406f4bd4bd9cef4ab41

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e47b2b3d1a66de09dd14b392e695ddaf
SHA1 cdd82a9ae42a27f50c5410c58cba81b4794ad78a
SHA256 6ee223c14a248676ee7a469668f54e980027c22c27287fdb773770e967f97014
SHA512 9ff39bdabd5ae9a1feadd3d96489e5c39047ca274f5b5b623a7dde9bfe08236199301f9259be254d3d2a65bf47ba317139b152bb429988939ecccce4ebb55ca5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 78ee129bfde5921e935aa36ce2973ffd
SHA1 cc90827e6f24088285e699afc8a5d63e79eebf42
SHA256 d41275b7156667c6c31d362ff95e72a698dc34a95a747e91ca17672fa1ffa7af
SHA512 20195d3c078142bf85f387a4eeaccb4a023d9c171d219f9d1a88ef2b2f3c5a6ef07f00285445d2ec7e5783732037dbe3cf142e7dc7aee10151b8ac6ea2f948aa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d7796804662c10d036a80db1942515f3
SHA1 ecc958acb5c628e269400103267c58e669206e31
SHA256 0dbe5c790c3552e4dc85e19ff1c328d7cd8d777176ae52a0502712fff50e7947
SHA512 3e111d6964312359295181d9099d37055187423b8688ca715aadc89f83b5556975efa72ebf8ec0af6f4b6adc7b3816d68adb998787764e925765e13e3e573ecb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 603cdfced8e3562d7c9a81d0d72828dd
SHA1 b2c15b0ab6e14dff977dbc80610904f00163de6a
SHA256 82a6200424d506d056912bf7729282aa476c8869f53e55602b40836c3a820b4f
SHA512 68ad3e9663977ba21bc65773d104c7395dc3085ac7ae354029951f9fd41c3241880905e096643aa688e1c3da9b7bbfc8c901fbae0e95eb41bb866e6047dde5e7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b46f357310d6ae27c2d2de491b160ad3
SHA1 80117e3aac537a376a5737d20e44295d124f0610
SHA256 51bac0a63bb2d5c7b2cff49859fd232f81eace84d9a56cb11ef8e3589333342d
SHA512 38aacfe3ca66755a84a8fccf6ba7aea73c3e2fd4c0482b8ac038d648bb700264ed335131e5c173421d806d6192fd3983d0fe9040b4e74c3e56e174e165978ead

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4ceba4472af5636346fdd867dabc8dfe
SHA1 15f0beabeda6b7d9c79d0522b630925bd0b0327c
SHA256 80dc8a77555a676b534a8410374c0d475050799c7e86c6f727136f22ef566c96
SHA512 7be0fd9f33267aaff3d0495a91bca81e525b2dc6dd4dd4eb6bee943323a778664bebe52bf75000921edeb681e232c69f655c98dfde5e2ab4fdd5566bccead5af

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f95be58e9adb4fc4e1cf8e2bcf90ae21
SHA1 caba2efafc4fd9e89cf16c09f24aebe0cf135ca6
SHA256 bba518ac1e1a26dceddf005c408cf72d944c82148fe26a72f8c5f50eab71d107
SHA512 9eccce44784736ef1e598f0e0b124b8d0eeadeffdd1f7f46eacb500187193d3fa7eea27c021f3a0995e45ae2013d7812daba7cb543081f63a65bfe9a31c64079

memory/1188-2025-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9e2017215b0c40589c21f81223abae24
SHA1 e6a2efa04d43e4d496b2ecb565746bd71402d92a
SHA256 26d7583d6651a90049e13d97f44985502afb361e00d08ab7206f53724834feb8
SHA512 71cb0b11bb67e3a3c51974fff1c5ce3caf5f783cbdc13669dbb2d22825c973931ee41b51c0ff87a6ecb523a11da7909f6153595c30edefa98e790a8a35a3dfde

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2d222e8a51d95f4fb6e75e6069c213b5
SHA1 4d723fe8405b36f6baa8694f6804ec24ea05d9ca
SHA256 af1523150926820ac03cadf95991dc7515db77e201154a91ed33c7ee0184f608
SHA512 ea62f80f463adfd1f8c561ffacbb1d90a0145e0e0e9a2908a0362478b87942634a8b916da804c106cde1468d18c07042779bb37f313fd42f7cfb903138a59cc1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0608b216a92ff815931e1bdd690a8a1b
SHA1 9eee1dbac01612791bde096d5861d99bc1ac5b78
SHA256 bb9cdab74beaabe929278e4accd090c385ebb99d344a67f8f7993fdce0dc3116
SHA512 7a08e368a1562bc30f43f139b188860f7c689653d5dbafb675e811bd1e57ed3458bb2b0bba990a5c1989d8d3dc1aac107d2c201834cc169ed23f54548d84eb83

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-10 07:24

Reported

2024-04-10 07:27

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT}\StubPath = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT} C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{LCQ80I27-R84C-4031-6GU3-3G73W170PCRT} C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Users\Admin\AppData\Local\Temp\server.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\server.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3088 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 3088 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 3088 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\server.exe
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE
PID 2580 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\server.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ea8c4603d1adfb55acdd4375d22d51c3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\server.exe

"C:\Users\Admin\AppData\Local\Temp\server.exe"

C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe

"C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 580

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4940 -ip 4940

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 584

Network

Country Destination Domain Proto
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

memory/3088-0-0x000000001BEE0000-0x000000001BF86000-memory.dmp

memory/3088-1-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

memory/3088-2-0x00000000015C0000-0x00000000015D0000-memory.dmp

memory/3088-4-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\server.exe

MD5 e897e941392b15de8a01a848aa24b7c3
SHA1 7dea6923f980f921674648a9b1f0ff667bdcc223
SHA256 7e4176debfec3f1f3f0b3171c28c8a40eb20df242165e72abcb282f8656723d1
SHA512 2318a5e3c1310e129a877b6e801913a1b3b2ae8a9805bf7345236a62d5220f4272c1fd4e8e75fbd5f0f6a6025bdfa8867580f2757f7d1f3fc3435419dcb07687

memory/3088-13-0x00007FFD317A0000-0x00007FFD32141000-memory.dmp

memory/2580-17-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1320-21-0x0000000000D30000-0x0000000000D31000-memory.dmp

memory/1320-22-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/2580-77-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/1320-80-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

memory/1320-81-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/1320-82-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 b05681d52dd61e255b735ded4d0bd155
SHA1 33bb64fae2d5e0b90c0341504e731d9f24d035f8
SHA256 3ac364f98ddb278debe624d2ae9dd3b83d0aef6e49a62db5a2ce43358571ce1f
SHA512 89f9c2bbe69e4471a701a8b0ad67113b84d7724d97d3edfee7f90f4e8e78318d4ab4cda5cbae54cbaa70bfe7edb29ce3de2bcf996d39c5afdcd0afdf5b1068d3

memory/2868-153-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Facebook Hack v1.0 - Hackersworld 2011.exe

MD5 64481ef51b2e4ef8b60ef509331c26e4
SHA1 64012a43b9f78509562ff587562b8c2f3764e545
SHA256 c18093af5bffdf7216cb897a712644d3960ed166ee48c9235eb9053d21714235
SHA512 47600ff236869efffffe5379afbcc757514039e4bd9961cd70c55f13a390e5a28e81a7db095baa0f6155fcda32ac7d400ac4f58de3091d21c486b5084d4f8013

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 95d06792e0802719f354aa54b8c6a68e
SHA1 ab7d87689acf39e67dbb0fe6c236225e3cb78c6e
SHA256 a772f6c653faa1b3e87bbc0d114b2f44d30f2b016364829fdd4af56757bc60e6
SHA512 b7996a2b5e7b669249a5279de66b48e671b1d319d45a448acddb69bda072eb2f37132ea4ac4dc02cff689c68404362ba4a6b3c62d68ab6586cbf7ee46a15af84

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 132e7c2b1a05794afa26511540cbeb29
SHA1 974b9aa93f83a7c8cfd8c9bac619a92d4cc83b6c
SHA256 6a1bf9e47527046868c165aaef79985fc9bc821ebf630e19be4a90b0e4e34a89
SHA512 7b60666dfd0fcf822c11868a72333c93c72bcb053704a82342d5e6626c4ad6013f777149f39e337fbfe4f17527817aef4cf884a92836e4d27446a86d3078b612

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c44a748a74f0b8a7a5f64f4d0c39c863
SHA1 f67d06b81065888cf576f8e41986abf0904e382c
SHA256 b18c2b35e8472d19c22d6a725055880851b426ebbb4ffb8eaef6089004254019
SHA512 8fce53565b7cc1d4802a9108980ab66d70321b680ab6542dfd0ae6aa920804291380ca267a0796260cf02356d82cc5f2d94ef2c7951e67a80fe58be6928ee549

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6275c3f079c6085e3dfbaa1151ac2e64
SHA1 a7370408ff3f2c4dfbfe462eade63022118ff798
SHA256 7049eba4eb5f80d7c63f414b2278444075e1577d519782e131048e1f5b722270
SHA512 6866911c664a8b93f284ea5f9fd26a6500f3c4c856149a0768e7febb489484757ddb1a8ad61cf1d471431d066fca611a5e86782f22f6de8a84a4e488d1ca8fc4

memory/1320-521-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e05aadbbcb64304389e23a81a3249758
SHA1 823cebdef388c88489b5cf6585181fc590fda922
SHA256 48b4d27649282abc25a8030bfc291d1def6d31725a9da5dbd91b5aa12c079b2e
SHA512 0179b79fdf8f31959077cc0dfb5aef4a2f12a798ec9341b47435184d818d9d6b8453888fbcab2114dc0fa02082c2210a1d3519a0d0987678f925ab4476f1e45a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c3fa070645b4047a9e293ebb3dcaa252
SHA1 60d519d493cd3827ab8a0c35b9d9bd36db111d2a
SHA256 eb2907fbf189227b72887ca30ba3f8d08fa5ed2cfdd93db86cc0a4bd7bcb018f
SHA512 2f64e611eeaaecfc919993cbe64c81a82d55129ff4befacec47e892191364bbdc1eea104b7585f5ec5fc906b13ae67f421863f63f77122f582c62157e4ce8c73

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fb93a5cbe2c1cdd2a4942269d15684a1
SHA1 51463225775a7c04057a5f4f130f6ebf09d68de5
SHA256 2dbad7849e3860d9b1924786be3f0313b7a9876d7a28d903501817a087a836eb
SHA512 4fbba7cde652fac56e747b5aa5d93e61ad5f4ded341c9d1589a85c3ecf149e8d04d33b5d42d5c4ee3d0779ffbb7501152e23f9f824be2e97469349667160fe7d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5c0fa3141f730cc9df5b2817102eb7a4
SHA1 f988752105a39dbc190f853f37bb8a3fef2e202a
SHA256 4e173ab00eda6762a949adab5d6b4caa699c6777357fc870e7f2671cedd1ea05
SHA512 bad74ee5748fea222857c1a43e6a83c4ed290d0b8ec3a4364d02b54663ee20d78ecb210a41d6bb7d62dcf4ce161558ca12cb8403c98b6bf1e0251076c680efc2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 868bf8079f734cab4515025fc0d43904
SHA1 db210b2bfa971ec4417369ddac306462991c3344
SHA256 d5f1eb82e9383ac09944c3b9d82ff86f1d9a4ffd56232d436098652f5ac20b67
SHA512 1206dbb2bb982d955e78a2353d602411e3f40a4fe94988894b056cc531a6d8deb295ceb160407e98e776ec46128b7c7d39947b10fc0edb143d3d12039de7b6c6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d9f78af83bce63606d35fd791f4fc208
SHA1 06bacebfb6a6dbb94a9c1bef1df5d9715bf0f21d
SHA256 838ba387d7ab6cce5ea2a1c22d4aa8c21934cb8a75538d47d4f1d003dbb643ef
SHA512 e53b8d61332e3ff5410bff645f6d31bfa3952228fb8c0b4686553f51adc0e61be4409101d248395d35c626e6bc9626dbce7e67868a838406f4bd4bd9cef4ab41

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e47b2b3d1a66de09dd14b392e695ddaf
SHA1 cdd82a9ae42a27f50c5410c58cba81b4794ad78a
SHA256 6ee223c14a248676ee7a469668f54e980027c22c27287fdb773770e967f97014
SHA512 9ff39bdabd5ae9a1feadd3d96489e5c39047ca274f5b5b623a7dde9bfe08236199301f9259be254d3d2a65bf47ba317139b152bb429988939ecccce4ebb55ca5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 78ee129bfde5921e935aa36ce2973ffd
SHA1 cc90827e6f24088285e699afc8a5d63e79eebf42
SHA256 d41275b7156667c6c31d362ff95e72a698dc34a95a747e91ca17672fa1ffa7af
SHA512 20195d3c078142bf85f387a4eeaccb4a023d9c171d219f9d1a88ef2b2f3c5a6ef07f00285445d2ec7e5783732037dbe3cf142e7dc7aee10151b8ac6ea2f948aa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d7796804662c10d036a80db1942515f3
SHA1 ecc958acb5c628e269400103267c58e669206e31
SHA256 0dbe5c790c3552e4dc85e19ff1c328d7cd8d777176ae52a0502712fff50e7947
SHA512 3e111d6964312359295181d9099d37055187423b8688ca715aadc89f83b5556975efa72ebf8ec0af6f4b6adc7b3816d68adb998787764e925765e13e3e573ecb

memory/2868-1426-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 603cdfced8e3562d7c9a81d0d72828dd
SHA1 b2c15b0ab6e14dff977dbc80610904f00163de6a
SHA256 82a6200424d506d056912bf7729282aa476c8869f53e55602b40836c3a820b4f
SHA512 68ad3e9663977ba21bc65773d104c7395dc3085ac7ae354029951f9fd41c3241880905e096643aa688e1c3da9b7bbfc8c901fbae0e95eb41bb866e6047dde5e7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b46f357310d6ae27c2d2de491b160ad3
SHA1 80117e3aac537a376a5737d20e44295d124f0610
SHA256 51bac0a63bb2d5c7b2cff49859fd232f81eace84d9a56cb11ef8e3589333342d
SHA512 38aacfe3ca66755a84a8fccf6ba7aea73c3e2fd4c0482b8ac038d648bb700264ed335131e5c173421d806d6192fd3983d0fe9040b4e74c3e56e174e165978ead

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4ceba4472af5636346fdd867dabc8dfe
SHA1 15f0beabeda6b7d9c79d0522b630925bd0b0327c
SHA256 80dc8a77555a676b534a8410374c0d475050799c7e86c6f727136f22ef566c96
SHA512 7be0fd9f33267aaff3d0495a91bca81e525b2dc6dd4dd4eb6bee943323a778664bebe52bf75000921edeb681e232c69f655c98dfde5e2ab4fdd5566bccead5af

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f95be58e9adb4fc4e1cf8e2bcf90ae21
SHA1 caba2efafc4fd9e89cf16c09f24aebe0cf135ca6
SHA256 bba518ac1e1a26dceddf005c408cf72d944c82148fe26a72f8c5f50eab71d107
SHA512 9eccce44784736ef1e598f0e0b124b8d0eeadeffdd1f7f46eacb500187193d3fa7eea27c021f3a0995e45ae2013d7812daba7cb543081f63a65bfe9a31c64079