Malware Analysis Report

2024-09-22 09:16

Sample ID 240622-fe7dgayenc
Target 01559a3880b976ffbc703ed70949f2d2_JaffaCakes118
SHA256 0403e90716cf3657a6ecdd798f9ef1b7e7cbff91901d692ec8affd3ebbc67206
Tags
cybergate ami,c:/ cws adbox 98.92.71.171,us dos-ms ip watch my hacker comunauter persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0403e90716cf3657a6ecdd798f9ef1b7e7cbff91901d692ec8affd3ebbc67206

Threat Level: Known bad

The file 01559a3880b976ffbc703ed70949f2d2_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate ami,c:/ cws adbox 98.92.71.171,us dos-ms ip watch my hacker comunauter persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

Deletes itself

UPX packed file

Loads dropped DLL

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-22 04:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 04:48

Reported

2024-06-22 04:50

Platform

win7-20240508-en

Max time kernel

146s

Max time network

146s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN} C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN}\StubPath = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe Restart" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN}\StubPath = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Windows\SysWOW64\explorer.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Actualisation = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inisial System Operation = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\ C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 2972 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1276 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

"C:\Windows\system32\Microsoft Corporation\Windows Update.exe"

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

"C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp

Files

memory/2972-0-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1276-5-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-11-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-14-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1276-8-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-4-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2972-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1276-15-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-17-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-18-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1276-16-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1208-22-0x0000000002920000-0x0000000002921000-memory.dmp

memory/1276-21-0x0000000024010000-0x0000000024072000-memory.dmp

memory/776-343-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

MD5 01559a3880b976ffbc703ed70949f2d2
SHA1 d52245e0a05faaedad8cb5413e17fe5d2f1b9ee5
SHA256 0403e90716cf3657a6ecdd798f9ef1b7e7cbff91901d692ec8affd3ebbc67206
SHA512 ee86c6b109319ef6fcd665f7f65cfcccf7e83ca306cc8d8fc6dd848f59cc367f840d1de388ce1f57a068705f944f8438001d671e4f925a199d6075f821e617cb

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 7f7eb51b27ebb721dccdc2cda543b550
SHA1 79984900bf5aa061fcb696c6ef62d6aec403a85a
SHA256 0339ee24ab0b4108f2ba59ab2dbf6b134bb4c0256363b81b0876352fb06d58e7
SHA512 c8f549d295997a4f6fca4f46755ce2869efc33480811c99d2157904dd88ab85cf0901c52b674d90f3b3b6845ed47c594b8d885f70500b280f219aa4d9e40c9f1

memory/1276-865-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1672-877-0x0000000003EE0000-0x0000000003EEB000-memory.dmp

memory/324-885-0x0000000000020000-0x000000000002B000-memory.dmp

memory/324-881-0x0000000000020000-0x000000000002B000-memory.dmp

memory/324-902-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1828-906-0x0000000000400000-0x0000000000458000-memory.dmp

memory/1828-905-0x0000000000020000-0x000000000002B000-memory.dmp

memory/1828-904-0x0000000000020000-0x000000000002B000-memory.dmp

memory/1828-903-0x0000000000020000-0x000000000002B000-memory.dmp

memory/1828-909-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c99e4643f4c74a00aac44912412d245f
SHA1 47f99969a95c3cd93d977c28be3c0f2dcd1563e0
SHA256 90c4c395d4db89e7243e34534f6f7b0f2e688300c4829860ce19e0e4dac46eb1
SHA512 1007e9258ee981f36810453b29937c14b709ae88f4b2da9fe2f3cf92d08c057d78fa6c6c9b8ab2e065a070d69248ed6eb03d4b8eb2d9e4b12acb1f708d6a13c6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 9084b818f5b9eeba95ef1c4ddf62c5ff
SHA1 fbc7df4eb7401d7b94661b209d020007dbf8b725
SHA256 0ff058d33fcf73ac3048ab69b7298dccfd1270af03f4698546f47fd0a9134d98
SHA512 2598b665ceb0a716d21d036417a1c2c6f298a302f14ec35a7d0619a819264f24760ba6120eca7a5934d4d4c84461a603d74acd2baba1a36259cb5bd2a3d7469a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 e157191c4dfb6235ff567f050e6c3834
SHA1 6d0dd6fc573115375de942e0c50739c22c805f3e
SHA256 1295e466df26da4c62713777134e6af75f51aa8a520e7c6ba8886a955c419e8a
SHA512 e2104f3ef741734eeb150e447ef710474fed49b6c2bddcd31929b92794b625717f90747279d7066e76e854dfbdf87e4ca0abb750769ebfd8082349742af31bc6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 81707723f665b7dd8b9719e887b44f10
SHA1 53a68096a25fef9d81123f3e67212ef982d3e929
SHA256 17dd3d0af34e191207ce0ae3ceea5d93e8bfb1e638aff1619196c6d421537179
SHA512 0d567d6206c4d70522959c664af2126258f9df60bd3153a66fd500ee2f94febd605a5160c09713fd0889e3989dbfe98183be643caaa0eab776a8554ebeeab10c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d00f1fc2655a11fe819a9b1e16f29e95
SHA1 7670c92c87c929f7b9af5e274fe40132b226194c
SHA256 9ce02c8ddeaf830aa32594d24400fa9dc20c0d71ce9907a73b24a2e44388dd7e
SHA512 cdd6c7eb8ba53f655164d94471e971a78690e499940019dfcf2f262ce25671696dec046fd59b32a8001efc963987bc60d68b83caeb846474a012ece8a9cb527d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 a258a8e36b4caf616341326e7b95a854
SHA1 e073f7307909561846efb6ad27b92d378b690453
SHA256 01f2c0d519cf6fdbb9891db591cee0b99625e6a582a037f50c75ada58b3754be
SHA512 26ea35192fbd0f388d83407778672a9d438cdedfc6f49534e5a956f5d1066e3e3790b0c0c8badbe0fa54b3a3278e0a069df7f5a9841b365b43b4f16d291a7960

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3e81a406535c290c9911b555cbffbc43
SHA1 781541798053c699c7f6aba58420cbf8585d0fcc
SHA256 3847ccc45659b12cadb59d4893344764c99735fa7453479aff97c2cea39eca15
SHA512 91acfb58919fd66300a2ec0e21590e14e6ebc2f1b73ea52e5cfc6a8acfd0976d7489df64db81d7d65fde2000928dd2384823c8cdc3b99837191f44915acee99d

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 73204860cecb5c0022b8b1b2d1b54212
SHA1 25dbff7ae940b8b3b166d23649600a173ad37920
SHA256 22ab143ccd9e095a4a7a0849f6d63fff284e1b94d018afc5f0743e4d9fc78f7e
SHA512 1f66a2dc5b12b1f30e56ea6bfa2303f83ad8ca860daf5c15e277ef7a10454999ea880e7d8a3632076fb412c87e9e3bf00ca788b67baf8ee64c5ea32d08260c24

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4295e728a491a01a51b11c952f6d13ca
SHA1 b2f5db2e4ac672fe5e4a8d8e6f122f611cab2eed
SHA256 830a835cb5b24051a815463067a30933b393f50d0a15b13cbcdf78ef436a5d3d
SHA512 7e4bedd5e49a7d59ca7aa388cafce27db69d666a28ffae654d6dd4320673c16fc0c3cae6a9bd209b3da56e9036e202f34b5f8cf9b70ae243bbd9cfc2b0c5c31a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 933a02388bbadd241dcef856c1cfea0b
SHA1 7395e3c1f7c97c1fa32342255345892dc0ace286
SHA256 2800cc89ab2142e2b10778ec30be530f2aeff5af1577832a40491e63721ff99e
SHA512 ca33b31751b69efa455f7589b2ec9423cf627116e4ee5ebb34b18c02a9b7cba10a66b8514da3048bdfdfd3bd893e39c7a3b7de0bfb68689d1bffa13dd79834c5

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d09cb909f55cdc4ef12b6b713d5b23ce
SHA1 6795b00505050a4d290b645078ec88702f48d90b
SHA256 6fb9af5bb1615b410803b13980965128ba63ba0af6c9a349f6e355a92d7c381a
SHA512 4f28eed9f1a1e1f8ca2f26d5fbc118be3e2c179f59e09a617af1610d43f348a1eff2901af489ea4d49d8c8cae8ca3c0959736347f6f501e28f714386e2faf297

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 04:48

Reported

2024-06-22 04:50

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN} C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN}\StubPath = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe Restart" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6M6YL612-1IN5-01C0-6DRY-I6VOA1DGD8IN}\StubPath = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Windows\SysWOW64\explorer.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Actualisation = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Inisial System Operation = "C:\\Windows\\system32\\Microsoft Corporation\\Windows Update.exe" C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\ C:\Windows\SysWOW64\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe N/A
File created C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 228 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4708 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\01559a3880b976ffbc703ed70949f2d2_JaffaCakes118.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

"C:\Windows\system32\Microsoft Corporation\Windows Update.exe"

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

"C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1604 -ip 1604

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 564

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/228-0-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4708-3-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4708-5-0x0000000000400000-0x0000000000458000-memory.dmp

memory/228-6-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4708-7-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4708-8-0x0000000000400000-0x0000000000458000-memory.dmp

memory/4708-11-0x0000000024010000-0x0000000024072000-memory.dmp

memory/2072-16-0x0000000000D30000-0x0000000000D31000-memory.dmp

memory/4708-15-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/2072-17-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

memory/2072-77-0x0000000024080000-0x00000000240E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 7f7eb51b27ebb721dccdc2cda543b550
SHA1 79984900bf5aa061fcb696c6ef62d6aec403a85a
SHA256 0339ee24ab0b4108f2ba59ab2dbf6b134bb4c0256363b81b0876352fb06d58e7
SHA512 c8f549d295997a4f6fca4f46755ce2869efc33480811c99d2157904dd88ab85cf0901c52b674d90f3b3b6845ed47c594b8d885f70500b280f219aa4d9e40c9f1

C:\Windows\SysWOW64\Microsoft Corporation\Windows Update.exe

MD5 01559a3880b976ffbc703ed70949f2d2
SHA1 d52245e0a05faaedad8cb5413e17fe5d2f1b9ee5
SHA256 0403e90716cf3657a6ecdd798f9ef1b7e7cbff91901d692ec8affd3ebbc67206
SHA512 ee86c6b109319ef6fcd665f7f65cfcccf7e83ca306cc8d8fc6dd848f59cc367f840d1de388ce1f57a068705f944f8438001d671e4f925a199d6075f821e617cb

memory/4708-144-0x0000000000400000-0x0000000000458000-memory.dmp

memory/5000-145-0x00000000240F0000-0x0000000024152000-memory.dmp

memory/1604-163-0x0000000000400000-0x0000000000458000-memory.dmp

memory/2952-164-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1604-167-0x0000000000400000-0x0000000000458000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 c99e4643f4c74a00aac44912412d245f
SHA1 47f99969a95c3cd93d977c28be3c0f2dcd1563e0
SHA256 90c4c395d4db89e7243e34534f6f7b0f2e688300c4829860ce19e0e4dac46eb1
SHA512 1007e9258ee981f36810453b29937c14b709ae88f4b2da9fe2f3cf92d08c057d78fa6c6c9b8ab2e065a070d69248ed6eb03d4b8eb2d9e4b12acb1f708d6a13c6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 9084b818f5b9eeba95ef1c4ddf62c5ff
SHA1 fbc7df4eb7401d7b94661b209d020007dbf8b725
SHA256 0ff058d33fcf73ac3048ab69b7298dccfd1270af03f4698546f47fd0a9134d98
SHA512 2598b665ceb0a716d21d036417a1c2c6f298a302f14ec35a7d0619a819264f24760ba6120eca7a5934d4d4c84461a603d74acd2baba1a36259cb5bd2a3d7469a

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 e157191c4dfb6235ff567f050e6c3834
SHA1 6d0dd6fc573115375de942e0c50739c22c805f3e
SHA256 1295e466df26da4c62713777134e6af75f51aa8a520e7c6ba8886a955c419e8a
SHA512 e2104f3ef741734eeb150e447ef710474fed49b6c2bddcd31929b92794b625717f90747279d7066e76e854dfbdf87e4ca0abb750769ebfd8082349742af31bc6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 81707723f665b7dd8b9719e887b44f10
SHA1 53a68096a25fef9d81123f3e67212ef982d3e929
SHA256 17dd3d0af34e191207ce0ae3ceea5d93e8bfb1e638aff1619196c6d421537179
SHA512 0d567d6206c4d70522959c664af2126258f9df60bd3153a66fd500ee2f94febd605a5160c09713fd0889e3989dbfe98183be643caaa0eab776a8554ebeeab10c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d00f1fc2655a11fe819a9b1e16f29e95
SHA1 7670c92c87c929f7b9af5e274fe40132b226194c
SHA256 9ce02c8ddeaf830aa32594d24400fa9dc20c0d71ce9907a73b24a2e44388dd7e
SHA512 cdd6c7eb8ba53f655164d94471e971a78690e499940019dfcf2f262ce25671696dec046fd59b32a8001efc963987bc60d68b83caeb846474a012ece8a9cb527d

memory/2072-497-0x0000000024080000-0x00000000240E2000-memory.dmp

memory/5000-498-0x00000000240F0000-0x0000000024152000-memory.dmp