Malware Analysis Report

2024-09-22 09:01

Sample ID 240620-xvx86sxdll
Target 08f8ec72bca8da09be211b1083500e72_JaffaCakes118
SHA256 88bb1402f4ed2a506555cbbd13abd41965985f952abf44b938cdef889b0f1462
Tags
cybergate cyber persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

88bb1402f4ed2a506555cbbd13abd41965985f952abf44b938cdef889b0f1462

Threat Level: Known bad

The file 08f8ec72bca8da09be211b1083500e72_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

UPX packed file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 19:11

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 19:11

Reported

2024-06-20 19:13

Platform

win7-20240611-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H21X225F-LN0T-V324-6IY8-62OP20G1E0G2}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{H21X225F-LN0T-V324-6IY8-62OP20G1E0G2} C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 1936 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2024 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

C:\Windows\SysWOW64\WinDir\Svchost.exe

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

C:\Windows\SysWOW64\WinDir\Svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2024-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-17-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2024-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-2-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-18-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2024-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3024-39-0x0000000000350000-0x0000000000351000-memory.dmp

memory/3024-34-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/3024-28-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/2024-27-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2024-23-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3024-46-0x0000000000400000-0x0000000000408000-memory.dmp

\Windows\SysWOW64\WinDir\Svchost.exe

MD5 08f8ec72bca8da09be211b1083500e72
SHA1 014eca46ec5a6e0a4ae1372ac69228b51c62c99c
SHA256 88bb1402f4ed2a506555cbbd13abd41965985f952abf44b938cdef889b0f1462
SHA512 a4043e9de58256e4a57515faf3248cd8515a7851b6c589cedfe913140d6508926b29c9d9e57e36ba23ab1bf1cb0794d3288bdea8d903e590f2d6ad4047494e28

memory/2024-330-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 dd41ba0599631d552ea04374aa487d1b
SHA1 1eec40f26a0e47c3f27aa87fda31a32348f221aa
SHA256 a5b7ac609e92ace3ed70f8c1f56a86e968a761443371ddb009e311cc18cdf9de
SHA512 0ea5a953068830d0897065242b57739132c7b2fd4826daf1ca3ec905439f5842df435570092a57db1c7a92bf06d857b656d6f8bd2b9158d92126b35042ddf93d

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

memory/2292-369-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2292-402-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b2dec9b885a0ebaf18835a9a22b93bcd
SHA1 e4025121e03c0d303f73f07422192c9c62688435
SHA256 fe8cf6e9cd9ada6c071409be1a7a6455e79854186ea93c1c5dfaa68cc9cca002
SHA512 8bcc4d20c8e317a9a769252ecf2c40c1f0786026ba315a780b0bd3ffe657b732f51822d5c3c218c2f2fce55e28d64fad3b694ca722b38806c32dc0fca65162dd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f26618aa479b2c1fffa930567d2df577
SHA1 45140debebb1bbde0c6acd98b790dee7757f6850
SHA256 60551db2eb2f30c213284888ba67d6caee165aa4892dd54a60dd3d06a032fdc4
SHA512 dc75f72797ef66c9201d1f0d988a64b3690c5e71b205fdab36ae993704b0ed25c047ac470479f591591d8ac8be1f188e3b2bc9a02acf50146ff070ad339d825a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 683b159692937e25540b81205ea065e9
SHA1 337ac39a44e41382795b6e91541eb4b1d074d3fe
SHA256 70e6e33518435800b6a3eeed44520a7e35ca8e08deca37da9a12d38262fb7de8
SHA512 566b6380014210015f46466e5348a5841f69604d8f12b3ecfea47c78b343ea4d68320f52381e996d417c5ee92b3bce618fab37b7f9946fdb93d66afd4e2ac545

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 625060264b52dfdc15c33eaeeacd24a8
SHA1 d72fe8fa617f569865e5dd55b0a9f5b7529aa877
SHA256 928d16b40621cbf96f73ceb7c0b69211150d666901bd240a8433cfaa355324da
SHA512 4435e911e9268e4f98f547f9e358e9506fd289983ff1efa63afd5abefd577bd384f09b09b36e43972e5109e4822c676f27cc7d5e787867a1f417ab0e4afefdf0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 240f6b9fdbc26b511020c40d14a8bffb
SHA1 b7726a55873e4f84ea90731f028e3fbb76ba7868
SHA256 2802e63b557696ce1da8f676a643f4a23ca9682e42467c15753e556a4a6e473e
SHA512 738f21f4de2a945560e8b37ac1503cefb95cd49b5575631dfbe1f06e1ef50881c767af4147678590eabc773060ba030797b5b2f3fd741e04d4b51c010729ad84

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 19611683119dca218902419db44a32b9
SHA1 0b19ce8b15c08fb0f8a29022675dc552df721d9c
SHA256 812bf94921d36f9208393624406d0acb9d16409e86752dec79a5954d22a4c5da
SHA512 8b86253ddc8eeffb0d2b953202d40f9d5082ae055aced1e9f2313bcd7a7ca434b6c09d3298b1d6c80c950cdf5cd5cd7e733f70127bfff54904d1ff38f7f217d1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b94a6e5e05c5a30e5bc6a78347be000c
SHA1 5dc545c5dd1d84706067995416b4f1eff7ca76e9
SHA256 3be7cf08f6de7c37e472f6283b6bbb764951f1d3fc617739508141bb955eb847
SHA512 6bab46f96eaec5e3d422931bf45caffaec35c6cb5dc0e32d64728d4383ddc2e64c6663e97e40ead062d9a8624db669f7ff29a545a627ed9f348af5979b30d582

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d32b618754d928fed06a6dfb40e99c88
SHA1 83ce0f10e388f5cbc6551e44ee7a46df7cff30b4
SHA256 98d661af139c994c4e81724c5356397e3d6a0ddda8d4449729487b71315e0f7c
SHA512 8bfdd68ec071a0c1af47f4e1bf21102b39be903d5a5f66cb5578f620b8485ee2ed64bc7a99dcf38b290be770213bb583f07458df37c94abdd68ccb0fbece0abe

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7c40e07b4730c466d94044e93e84c75b
SHA1 ccf7b6790c5e2ca80da0ca95d10a2a2ddf6e7d3f
SHA256 18b8c2674fe19ca529eda8d1130524773d2013a400f362bcdabaf7e05ecf0248
SHA512 f3546abe495fa3385c63dda1cc688facfe9c2ae86328c9fb03e45605145bf4b0fe711d17397a96a10db33af707d3438c6c79666ddf5b99759f86b61e97471d19

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9ae456b4fbebef6b848eb526dc883dd5
SHA1 388f7e56c2f94bbd8e7d942f8cd68806e34f919f
SHA256 3a0c59a05d81ca2f285356a5effe65a909d5b77aa78e423982e23b017e321a7a
SHA512 f75098f44e5a38138c7443cfd3915bf7f17d7dcbcddca62038fbf97834707ce066aa53dbb81e05858de2b1e733816dd9cd7264376db07565e7c58de434695e30

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ff6a41630abea130e7cd02a07409c931
SHA1 10e3edafb4820c6d7c07a4ed7fb3b4ea5153f2a9
SHA256 1b9d08d99c6c6bda9a461341a4b92ed3436808673d7a02ef4aa70056ee6d9685
SHA512 8c70af1ec5668075b33c105bbe1a20c8dae7bb51908222cc8a820424749c59eaa9a089643f6f6470a15904dee673e657b49fa526cbe4dac0f2b6d63dba23f160

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3c982da4921279f2241e8fb1ff54fc27
SHA1 4f427270a0e84fee52772d6537de72aecf04fb57
SHA256 d261a044899034e25fa226d2811c21ab7b9ad1be63b74824fc94420d90a0608d
SHA512 c194400cdb9f3a36ca0425539591901d59b36f0e56bf2e02491189d42d2b14a94b6a6cdf14df86e86d4d90ddc27410252e495a9f30c58954233c5e2cf9668cb7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2f3450654a37c95ce710ed31cee14932
SHA1 d18c396eb043029187feab57568a6990b569b5d3
SHA256 2a616976263ed4efca28a4287959be32913c4a34431b6b423a068cc58d32f34c
SHA512 9ec09ebc86104bd6ffb71ab95bef1fab9ff62498692e7e3292214c6aa9fcaab2054cf6c65d1914ff744b6d0254cede805fbecc90e808bd069ff57abbf7484744

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6b3bf63be22332d6af1f1926ce2953c6
SHA1 386b03a7a3688fef998b675953bb4494a4589abd
SHA256 d118bb8121bf108b80bea4e49f2ffdb7abb4e97eda411f99ab6859391d988ea2
SHA512 6cec0b476236db2e4d3069834f5539608d0cfed15fa64a36f5204ae0bd2089ae7ac327d914dc4efc024e6cf7699ec7f4b2a8024dccaf86d7dfd37f4c3b529d89

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e61f62448ee6053464c90df78a8255ab
SHA1 2e5c47e73e6aad4388f48efaf47a60263997531a
SHA256 f62fb4683bca21cd8c962ecf83cd19417e48107490b2aea382dabff50ceba85a
SHA512 9d6b1519fc74729876eddcbd2f940eef73895bc4e40760ce05ca87c6479d7d3465de748caf3bb35b59fa3ccc90f44d62a92995124399fc59c43149f4aa386011

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4831bdab05353c8fa0974d346b421f31
SHA1 9529f8de6aaf585ffbca4db0c0cd773c67e94573
SHA256 62821989f3649a169842f89bc017c3e33cb4e94ff7f0b655bf176888cd804de9
SHA512 b5cab782b6d4ee15d603bf766fa413cb169ecb695a901a7c4117803f613c4f3951d09b00a04d7a6631a8840c16629305b8e03819c051e8219faa408bddfe6b0b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a9f658ea403f65044ca1a329b6150ed4
SHA1 4ee0619c31484b2e0c1457b3720b0dd81f4386a9
SHA256 55e9c96bbb01e3441fd16fb49ce30825c160f9bc0aa952706b88d66db15396ad
SHA512 46939a944a47fe03b826556e83404204391d0e97fedbf6c5b124e9ab57cf369ef05e0b41bb8ff056c8e0382999f5a92c7bfd3f1b7fd6d454bf2b671e25e17d3b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 67d235303912d0b1e951997dc39cf65d
SHA1 cb8e2d8d407e874fb5c4587b9a9fcf56512c95e9
SHA256 6c39c0fe9036bb9d4d934e42a0cd2f8ed664a8babc7c1b9adadf3de8b3c00623
SHA512 79a1088396c3050b2c06333c42f299c0d528008545c15b2518d95f1ec0acba95a5be44237b58bf56ba3e80f9561c5b3b50d60215ffafb2998b9951214625f73b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2a714ad8e55068f6b1df6ce738bff563
SHA1 3aca5e185ceeeb21447c0ccf0deb1c9f848a9ecc
SHA256 29d7a09e1ee13fe7babb621b80d9f07a725e8cb327b298334a329bf0a16b2b0a
SHA512 199d1abbbb8c3e2e1efc500822bf7a592fb11a6857eea9e10b16f215ea6dc72f7436649004772b4f891f3048c4eb451886a13f8b138a9f66a455d6adc7e23ce8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 19:11

Reported

2024-06-20 19:13

Platform

win10v2004-20240611-en

Max time kernel

139s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\08f8ec72bca8da09be211b1083500e72_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 464

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A