Malware Analysis Report

2024-09-22 08:59

Sample ID 240620-fkfgyavaqk
Target 02f8f34ed6be9f720abd293e5503d883_JaffaCakes118
SHA256 4f0b8a924905b1e3409ebae9bfd65f95d2668fc1cc415e50333e813ccc587db9
Tags
cybergate cyber persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f0b8a924905b1e3409ebae9bfd65f95d2668fc1cc415e50333e813ccc587db9

Threat Level: Known bad

The file 02f8f34ed6be9f720abd293e5503d883_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Checks computer location settings

Uses the VBS compiler for execution

Loads dropped DLL

Executes dropped EXE

UPX packed file

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 04:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 04:55

Reported

2024-06-20 04:58

Platform

win7-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\WinDir\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcHost = "C:\\Users\\Admin\\AppData\\Roaming\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcHost = "C:\\Users\\Admin\\AppData\\Roaming\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2872 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 2872 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 2872 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 2872 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2328 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2928 wrote to memory of 1224 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Users\Admin\AppData\Roaming\WinDir\Svchost.exe

"C:\Users\Admin\AppData\Roaming\WinDir\Svchost.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 556

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2872-0-0x0000000074111000-0x0000000074112000-memory.dmp

memory/2872-1-0x0000000074110000-0x00000000746BB000-memory.dmp

memory/2872-2-0x0000000074110000-0x00000000746BB000-memory.dmp

memory/2928-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2928-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2928-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2928-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1224-13-0x0000000002540000-0x0000000002541000-memory.dmp

memory/2928-12-0x0000000010410000-0x0000000010475000-memory.dmp

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 ef47ce2a061a112e65670b19dd539577
SHA1 4fccf4010cd81e7e3c6d47609ea482c21279c01d
SHA256 31da33b72978822ca3fe0ebeac6e815a18855df82cc23ce1f0d099f47c3baeda
SHA512 e905f863cc18fe27db6986d76590f4948a3158b5241a9023de1809a1c7d47575746d95334706ec1829a87131e278af396c1cab3374935c9125d00199f568432a

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2928-1875-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c885315d2936176f62aedf0e636a9bce
SHA1 048449e2e3233c13a41695070e0f4277350ab073
SHA256 36b0a91b7a76481e4766f43c8aec3a91c07826ac4e47032d8b3196eb21685e44
SHA512 a108ecca267ff8ca9bf05de836b5f5513d7f9956b4f3ac87bbf9dc32a72e9cc629e5bf4f42f9f9ebe05ce3e82fcbfef696abcec40c91a7689d6e8e107de7e33c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6ebeefdfa2e193ec21b589a2b26be73c
SHA1 82022fc68808e5d9efe246a4f84d32480df2b864
SHA256 58793389439d0902500ca6f42f9114bce1e0d0837a389a408963712e4f41c17d
SHA512 66df2813f4767fd641989ff6b1449cdf1a8c4ded787c2b8cb0c82799d2891255e837c765584011cdebe39aa08f20faa7afa08eb6fd70c2274656c253d44b8321

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0b39c6d499f907953467290b2845b35b
SHA1 65f1511475bacfefb6dd46b37ec8c09150527c62
SHA256 a4d854b472b693baa768d4a09a7c7f1f56ba398cd8b9ebd472556a5ca8c7ecef
SHA512 bde7a6c0d18ecc9f61b0e603775ce131f2e0c60b0bb500e2cd10e0ad5cbae6dbadeca8459c8e53555dd9aab7a6d0d2f0a3ed19e8a51cf3d7d750d5c66ac21ac1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 abe1953cc4687047ee5d71832a4540dd
SHA1 c0138311e28ef545ab7225a7d37a925b9f004f6e
SHA256 7be3c294f5ff211f654345f260831c7c5abc230a769ad5f818c12680c5ad1bf3
SHA512 cbe449bfaf3ef956fb48853e173f5ee7d319fa286a5c81fe8ce69a9eefa64927c214ceb8dde54c7468319b5e39a47c02407428c585536483ceefe4b88f9ef49d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 973299b43dd7974ed624ef0b3db55106
SHA1 8e40bc26babbb5294b85ae1e3c77257dcd601708
SHA256 964ad96c3ab0d6231003ac3d208b754953e6ffa7ae9a345cb3a800ef05f405e2
SHA512 85a7c9e4c9ca79a444f1d2521784a62dbbc23367fa97eb8944920a07c21d20687c621b01214eff48e658ea7fa995bbf77c7b11894fb00e41657b7345072ed3a4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 615e38ccc0e0dab48cbdaf133e99c7db
SHA1 e14880fb688054f307722542c500143e67917491
SHA256 ab0b45f9a6d66dff875990ab0e50abe8d10f1c7ef070a593864184e34549966c
SHA512 2905c4670db1ad9bbd5efbaf7aa706068f78ac6645f52f2d1377b86200e05782c6127e741f000d1cc6d3d9386a5a373aec86a6274d9798261d6fca307ec11314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 cb15d28931363352a9d97a37197d4696
SHA1 f3e55413330ff627545e06e23c91aff3ac762f72
SHA256 33eaf182e4ca5ae8c99ca26a28e813efb6458b2cffebcfab8b2c9031f6802cdd
SHA512 27a15db990c60d90b8b4534f2491e4f231d76a4eb531bc8b131978194f655c8b2f88a7f908c6d5ca9544614a007d7940dec5b469cece94068f54a0166bc56691

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 093f3fc8f8cb9ffb6d031e2f64d52228
SHA1 724a501fcdd01b003e37cea9e38207112f7c50b5
SHA256 7ee321ec60405e80c02db49e2979a4c803b39e1dada63a7c5d4e5e520d57ca20
SHA512 2ecc646a1eb461e907b8093b748b1476821eef1e65428dfe8a6e72e8bcd1ca7b692b634339f9f775abea775e942040636964ae9a15e6ba68cb395c5e2b575598

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3177ba8c1bfc986dd45834511a1659cc
SHA1 733c4663a3dfca2cc6a81d47d3e291c631864a2d
SHA256 dacaceaac4d5887cd2d33b3eb5698c988663aa6c37f1232a6f8687b3e0866abf
SHA512 5cd90df97e94595ee9eda05e8593f3b443e19d7e71f8419c7332eec4918caf6d8798e2a2dc3450c664ffe826a355782c9f5fca23b03a635f8f7a1028850a0c77

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 15bb8fd10dbf8f5b1774addb61348a4d
SHA1 c1a8fec7148e97fe1bf123111eaf1566ae2891b5
SHA256 6634d46d6a001272696f01446080aa5fed7f2f14189116216ed6003198b1ce52
SHA512 9947807b3bc93f19d1291771a113280ab1e130e3defb8c10cf27ac394e266d27053c20dfcb074ee98f14b8f91bdebc56cbbb4567c7ffe3962b3b52e150214517

memory/2872-2453-0x0000000074110000-0x00000000746BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2254175ad8792f9d3adbe39e5e6c937a
SHA1 f43c4732262ad74ffd3b2a2c863372d9c3c866d0
SHA256 bd6914407714734763205267ecc509b05f1d35dd1ae00cfaea62684cb9c666a8
SHA512 549ce4c7bcb13e85b19560cf2d5bc43a969cb92986f28754ac8b6d55705af2c0a2e970bb04d90076d83365f88d732fc540b37e3cde9113a95fe51229a7fd94f2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c7a3d69685ba41d2f2a85a0451845fe7
SHA1 36bf139d14e7f27d776df9bc52baa1c268440ae9
SHA256 71e65e77a7fc74a724a4f3e1c1782dc55e321dc8866b2e25a0a5ad1fe1c7ad09
SHA512 039511c2b60b775ca504260716b2c8a07304f44e37b3fbd826cdc7d4242dabb3a6ec00ed350967dba267ff9dc42e57d6e21136f0751bc3fe80bd9f03c89d38b5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 dfeecedde7ec82fc55c6f8caef1bf20f
SHA1 af9b7b0b94cd3ba3141263c78ddd82ad92820831
SHA256 ecd6f6eda255436377a19cc0eaec43238635a3100631a4d9800ad8c9da54cb5c
SHA512 2268806fd8a31714942f428f7551a8555b61965796041fab6f947a7e2f468a84ca7488e4b4807bb3689405a554ea079d4585fdc85899f372bfb59afed4a2f587

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 836bd72a0b3387892728f7dcc8e49c80
SHA1 fae31c86f70e99f1a6e713adc07f9cfc9875a799
SHA256 04d17a18e54c00e9c933f61ad77699790ff1b8e20bdb4a5a334c5467ca276e19
SHA512 9c6200d2342d930c3c7be4796a6d1c480658207d6409022c0e57218d1a381fa9407e9048387ef3802fe0096af4708a41ebafa0aa19efd1d3f1bd47c5c1525ad1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b90e8b6619d27bba78418431c6a6b39b
SHA1 e55a6b443b31b76c760ae84616f9ffcd8646ba90
SHA256 875d2f871ae33cb2fb741041c2301b435a86a35671f04003cf49b0612ad38049
SHA512 97a2525316ee7eb749874b1bed01e7654f94cba7ef02a1ef1202115bad407c9a5e13e731d0f0bf61d08b19c94594e8d441b9202bffd6590429541b70ec26bdc9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 65d558b9a83916430da00ed65ef78f51
SHA1 8b63254746fad929b254ef63149278e373faef67
SHA256 4d8f67d65b313446bda1971ca2fe335e9bec985af842466e29f7aa6a66d9207d
SHA512 7fe0a2c2c1e068afb5bf6acad9cd62a4be9f8d7b3bd26c00e48c29d0c91d5f92fd58492bda308427c8d619c9211480fb22ffa159ee11eb7332ddedd05cc77ff7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 93354b043f5d14730c290075a2166bbf
SHA1 5412587e665178f024d3b432b30d192a5c4b6b19
SHA256 7344e948501648ceb3052f039fe0cfe93f8cbcebd72b40f804fbfce82f2eac6f
SHA512 d9a67116f44f690aab414be72305a6f8c9655e8b03c3273b0d62e7af59f398f865b3198defebeaa4648392ea9911152458641fa4d27a23cfe696594b1be57097

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9dee53d7c63e9c4ad62b17c47d0364be
SHA1 e6f10ea9731174af07644dd3778d443034b5e108
SHA256 0affa6faa800e81e07b7b6f04dba29d1f6ba18e3c046c2a11310cf00b635707a
SHA512 4f37ab177ccd8f8063eebbcf016f140c36570d4a8a70e36734407beecba057cdf8df686780e62c7b33fbcf1a74debf5c664b7af2fa59b7aa786509a691430024

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 04:55

Reported

2024-06-20 04:58

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{V8668FOD-X384-VUPI-DXR0-Q0U7DHQ6EVU5} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SvcHost = "C:\\Users\\Admin\\AppData\\Roaming\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SvcHost = "C:\\Users\\Admin\\AppData\\Roaming\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\SysWOW64\explorer.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4188 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 4188 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 4188 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3908 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2140 wrote to memory of 3428 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\02f8f34ed6be9f720abd293e5503d883_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 5108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1112 -ip 1112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 1048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1112 -ip 1112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5108 -ip 5108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 1056

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 www.server.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4188-0-0x00000000751C2000-0x00000000751C3000-memory.dmp

memory/4188-1-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/4188-2-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/2140-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2140-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2140-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2140-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3908-8-0x00000000751C2000-0x00000000751C3000-memory.dmp

memory/3908-11-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/3908-13-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/3964-14-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2140-17-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3624-23-0x00000000011C0000-0x00000000011C1000-memory.dmp

memory/3624-22-0x0000000001100000-0x0000000001101000-memory.dmp

memory/2140-21-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3624-83-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 97fc968ab3757e2218fbca3fd77b2b76
SHA1 25809cc70ba7c279a1605ea96edd87f940bf77ed
SHA256 8c3e5fb024b9b7b88ed89faea144bc9be29a00424efd847aa5a86f7c5174cb14
SHA512 b07097990a6bbce671a487dbdd6eb5e7116e9615bf6a431cba6fd39b1b8b1be7bdc1b572862934a685a9ea9269e058aa77adc14fec5e9f5bc369979cb6021a64

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2140-249-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3964-310-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4188-349-0x00000000751C2000-0x00000000751C3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c885315d2936176f62aedf0e636a9bce
SHA1 048449e2e3233c13a41695070e0f4277350ab073
SHA256 36b0a91b7a76481e4766f43c8aec3a91c07826ac4e47032d8b3196eb21685e44
SHA512 a108ecca267ff8ca9bf05de836b5f5513d7f9956b4f3ac87bbf9dc32a72e9cc629e5bf4f42f9f9ebe05ce3e82fcbfef696abcec40c91a7689d6e8e107de7e33c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6ebeefdfa2e193ec21b589a2b26be73c
SHA1 82022fc68808e5d9efe246a4f84d32480df2b864
SHA256 58793389439d0902500ca6f42f9114bce1e0d0837a389a408963712e4f41c17d
SHA512 66df2813f4767fd641989ff6b1449cdf1a8c4ded787c2b8cb0c82799d2891255e837c765584011cdebe39aa08f20faa7afa08eb6fd70c2274656c253d44b8321

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0b39c6d499f907953467290b2845b35b
SHA1 65f1511475bacfefb6dd46b37ec8c09150527c62
SHA256 a4d854b472b693baa768d4a09a7c7f1f56ba398cd8b9ebd472556a5ca8c7ecef
SHA512 bde7a6c0d18ecc9f61b0e603775ce131f2e0c60b0bb500e2cd10e0ad5cbae6dbadeca8459c8e53555dd9aab7a6d0d2f0a3ed19e8a51cf3d7d750d5c66ac21ac1

memory/4188-509-0x00000000751C0000-0x0000000075771000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 abe1953cc4687047ee5d71832a4540dd
SHA1 c0138311e28ef545ab7225a7d37a925b9f004f6e
SHA256 7be3c294f5ff211f654345f260831c7c5abc230a769ad5f818c12680c5ad1bf3
SHA512 cbe449bfaf3ef956fb48853e173f5ee7d319fa286a5c81fe8ce69a9eefa64927c214ceb8dde54c7468319b5e39a47c02407428c585536483ceefe4b88f9ef49d

memory/3908-686-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/3908-687-0x00000000751C2000-0x00000000751C3000-memory.dmp

memory/3908-688-0x00000000751C0000-0x0000000075771000-memory.dmp

memory/3624-692-0x0000000010480000-0x00000000104E5000-memory.dmp