Malware Analysis Report

2024-09-22 10:53

Sample ID 240622-whjpks1gqp
Target 034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118
SHA256 57c2f366c9b2b5862e2ed59461cf8ccb06fa39416c3f9eadc118c9546ca574b1
Tags
cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

57c2f366c9b2b5862e2ed59461cf8ccb06fa39416c3f9eadc118c9546ca574b1

Threat Level: Known bad

The file 034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Uses the VBS compiler for execution

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Modifies registry class

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-22 17:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 17:55

Reported

2024-06-22 17:57

Platform

win7-20240508-en

Max time kernel

147s

Max time network

147s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1612 set thread context of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1612 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2620 wrote to memory of 1168 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\svchost.exe

"C:\Windows\system32\WinDir\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp
US 8.8.8.8:53 www.server.com udp

Files

memory/1612-0-0x0000000074411000-0x0000000074412000-memory.dmp

memory/1612-1-0x0000000074410000-0x00000000749BB000-memory.dmp

memory/1612-2-0x0000000074410000-0x00000000749BB000-memory.dmp

memory/2620-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-18-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2620-14-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2620-22-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1612-21-0x0000000074410000-0x00000000749BB000-memory.dmp

memory/1168-26-0x00000000025D0000-0x00000000025D1000-memory.dmp

memory/2620-25-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1044-269-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/1044-271-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/1044-552-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 056b0e90db333ea6ac4cb19ce90c918e
SHA1 80ba025bbcb672c910081b1cc0a520301565ba19
SHA256 2ec3705a5acc355a5010037aecc20ddc127b26889aa61ea8d3f21ff7de4f441b
SHA512 b1f6ff07d2d0d013e13c67147fb7c1990aa47b6ccc5064b79b67ac4525afe5d84058350460a266ebdca6be30cc5b448bf9c60259464bc405ffb1311a90037002

memory/2620-883-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c30960fef477e852a47b988d2ef5b9e4
SHA1 076b47057a116a2444f2ef0edc44c466cab4f83b
SHA256 7d0855c1b1599b620993f71621c21f32b0473a41ee3b2f697fb46faef3950419
SHA512 c023092d5381ffd3ac9c1bc9ffc5e347c30c0767d8bbc423017a651abcf0ef2eddf9f865bee33e76b3d16a06e9034d35ba2a9d0ffedbf8091017b4174d128972

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f51af7fafa3862be4509fd88b9c3f655
SHA1 f0172f88f7e322699642b861cfafe62efcafe229
SHA256 86461af886d88710cc6c1719954f3d69a555a437584f830abebacf3d5aef0b3f
SHA512 efd3d35cda03885975249c4a0d87ab2958b825cb085e2ae477b8d8100842a83fcce1fbb1ac77bc6346f38359d8b0740f2b639bac5ad9aeea2ee47bfb5778c550

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ba2a634cc0761ceee1bfe26651aec374
SHA1 80218a54ede888804c212323041f02ad2e953a92
SHA256 aaa5ba08d235cf84ed9487197d9bf6a4c46c0a8708c9af377b638ab12b8d1042
SHA512 d1c657c51e25fb978216f4f02cca200495acd1c5522c0a7f13900dd1fde16a2875717eb228d3a1557002403f799dfb0ce20a22a12a45bd61610f720b01886b13

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2c3f0d08f52dfe2fe45091a1e872010c
SHA1 610218ab2c7414f7672fef2fd3ef93692a5347d6
SHA256 53f933639e3b0ddac7ce8f436baf3be4b7339426e5fb9d3b4507340199987bba
SHA512 6ce9f0909f1c1216cb1ef45479f5d1d3921ddc952cc0692d06f8478dcfd89b7c8eeea97dea0555d73afd12935f7997885cd6ed9ea84d2f5ea23552e9c1e33e43

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 dab3ab6af857941a432bd2bed3cb8721
SHA1 9d0f0009d730cb9231917a7bc92f11a8ada206f6
SHA256 fef72efcf924cb23f529bfffa37601dbe212e771ea2a554ed5e31c754e61681b
SHA512 a48ba992dbd251e75936e1f477d9f3a2b20ba88b326a2bcde93e4a3e0cb40aaede4e9d18b0ee09bf0b431ad60395d92ff32961e3f95ff6e3d58e3baec77cf759

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5768287b9bb487b7815d90eccde2599e
SHA1 68117fcc4be631e5a3de0a2aa73b4fb349fdfecb
SHA256 1236d21340debba72a8240645bbe3169da153053b726305e4ccf6d27069893c8
SHA512 4a75e7021bd7c7237d272693973b8bc1ede67c08ff4d0229c36cfcac5bc9209c82ca0028a5f61fe9875d9a007be35fb8b979ae5d990dc66542645d56022e8f30

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a961c49edf30ef0958eace65b42aa04a
SHA1 e17c6e828db69fa3d1bc633eda3744139880fb9b
SHA256 485c5223593279a1bdb1210dfcd80f2e338ed57a1f90ed82611774ea1ad7b466
SHA512 427cd326a42e31eac2122bf16fdf6cae1be7fefa87a8b171f27eeedbccc6af7e734362bef119b10328ee9a7a8f2cd20f478f65d6274bc356a383fd252291471f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d96e5c07e482b4c852d18157c0aa21dc
SHA1 e02539a4e5a5d8fc0a65f9c8dac8940526090412
SHA256 021d7502a4439d39a21f3e4ce74cb98ed064069a5823ae1feeb8fae193f799cc
SHA512 e8bf96703a810dfa875499bfdba8623e9bdba7c9ce989cbc26110d7f1b2779e6d0d6b72d4de642bd3e20577518c48dd3e5eed76771956fc58201ccaf2df9d179

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c952e417ad651df0f300c763eb27ef8d
SHA1 54fb6cad43ea46dc2e0b9816eb8c14badca6b235
SHA256 96f677552ac4f49b77ab3d7b18a2f09328817e9f46a929ec232f69f35de096a4
SHA512 1a0ba84fe1bb5df26ccd5d9a2fe1477669d2a6aeb2c6151a8647c5fbbb3eb4d43eca9bbdfa5c70d288ff290a33b1a9940de4d493e2166b9ca5c0b94c9008c42d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ab07b92811411d06d5a643fa9f458c86
SHA1 ad1fae2f56ae67ab90ad9de06966a916e530ffb2
SHA256 d71dad1a1ee385c0f6222232ed9f37254ed2a4bd9dc074ca28de23bc0b47214e
SHA512 74f0b8080c529f6fdddf8c67ec32f7a9b1887f43a92d3f2883e169b29c766ce0f393e82c531f0869b6e3924b09a7af0d9559f0154f6f5a960c516e1dbf933f04

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f57c42d9e57fc391ef933d10518ba19c
SHA1 234a10bb2e43ebf2c2ca2acaf6df68ebe41127f7
SHA256 0af929d6292bac3dbac8da8cc368912e51c74aa56346d9555a18961377fa4ea0
SHA512 37a89cf7620771b158bbcaaebc283d547db3cf43e012daa7097b7e769a83f65f311672716590df945868df872d122a598bd71d57ad902039f2c6b9b28087fa0e

memory/1044-1779-0x0000000010480000-0x00000000104E5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 17:55

Reported

2024-06-22 17:57

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

149s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46VU3N4W-61L3-67YM-2E32-483D35451IEN}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5068 set thread context of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 5068 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1076 wrote to memory of 3416 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\034219bdb8877738cd50fe3d6f68d9be_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\svchost.exe

"C:\Windows\system32\WinDir\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 udp

Files

memory/5068-0-0x0000000075572000-0x0000000075573000-memory.dmp

memory/5068-1-0x0000000075570000-0x0000000075B21000-memory.dmp

memory/5068-2-0x0000000075570000-0x0000000075B21000-memory.dmp

memory/1076-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1076-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1076-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/5068-7-0x0000000075570000-0x0000000075B21000-memory.dmp

memory/1076-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1076-11-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1076-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1076-15-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/1864-17-0x0000000000A00000-0x0000000000A01000-memory.dmp

memory/1864-16-0x0000000000500000-0x0000000000501000-memory.dmp

memory/1864-77-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 056b0e90db333ea6ac4cb19ce90c918e
SHA1 80ba025bbcb672c910081b1cc0a520301565ba19
SHA256 2ec3705a5acc355a5010037aecc20ddc127b26889aa61ea8d3f21ff7de4f441b
SHA512 b1f6ff07d2d0d013e13c67147fb7c1990aa47b6ccc5064b79b67ac4525afe5d84058350460a266ebdca6be30cc5b448bf9c60259464bc405ffb1311a90037002

memory/1076-147-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4232-149-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f51af7fafa3862be4509fd88b9c3f655
SHA1 f0172f88f7e322699642b861cfafe62efcafe229
SHA256 86461af886d88710cc6c1719954f3d69a555a437584f830abebacf3d5aef0b3f
SHA512 efd3d35cda03885975249c4a0d87ab2958b825cb085e2ae477b8d8100842a83fcce1fbb1ac77bc6346f38359d8b0740f2b639bac5ad9aeea2ee47bfb5778c550

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ba2a634cc0761ceee1bfe26651aec374
SHA1 80218a54ede888804c212323041f02ad2e953a92
SHA256 aaa5ba08d235cf84ed9487197d9bf6a4c46c0a8708c9af377b638ab12b8d1042
SHA512 d1c657c51e25fb978216f4f02cca200495acd1c5522c0a7f13900dd1fde16a2875717eb228d3a1557002403f799dfb0ce20a22a12a45bd61610f720b01886b13

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2c3f0d08f52dfe2fe45091a1e872010c
SHA1 610218ab2c7414f7672fef2fd3ef93692a5347d6
SHA256 53f933639e3b0ddac7ce8f436baf3be4b7339426e5fb9d3b4507340199987bba
SHA512 6ce9f0909f1c1216cb1ef45479f5d1d3921ddc952cc0692d06f8478dcfd89b7c8eeea97dea0555d73afd12935f7997885cd6ed9ea84d2f5ea23552e9c1e33e43

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 dab3ab6af857941a432bd2bed3cb8721
SHA1 9d0f0009d730cb9231917a7bc92f11a8ada206f6
SHA256 fef72efcf924cb23f529bfffa37601dbe212e771ea2a554ed5e31c754e61681b
SHA512 a48ba992dbd251e75936e1f477d9f3a2b20ba88b326a2bcde93e4a3e0cb40aaede4e9d18b0ee09bf0b431ad60395d92ff32961e3f95ff6e3d58e3baec77cf759

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5768287b9bb487b7815d90eccde2599e
SHA1 68117fcc4be631e5a3de0a2aa73b4fb349fdfecb
SHA256 1236d21340debba72a8240645bbe3169da153053b726305e4ccf6d27069893c8
SHA512 4a75e7021bd7c7237d272693973b8bc1ede67c08ff4d0229c36cfcac5bc9209c82ca0028a5f61fe9875d9a007be35fb8b979ae5d990dc66542645d56022e8f30

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a961c49edf30ef0958eace65b42aa04a
SHA1 e17c6e828db69fa3d1bc633eda3744139880fb9b
SHA256 485c5223593279a1bdb1210dfcd80f2e338ed57a1f90ed82611774ea1ad7b466
SHA512 427cd326a42e31eac2122bf16fdf6cae1be7fefa87a8b171f27eeedbccc6af7e734362bef119b10328ee9a7a8f2cd20f478f65d6274bc356a383fd252291471f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d96e5c07e482b4c852d18157c0aa21dc
SHA1 e02539a4e5a5d8fc0a65f9c8dac8940526090412
SHA256 021d7502a4439d39a21f3e4ce74cb98ed064069a5823ae1feeb8fae193f799cc
SHA512 e8bf96703a810dfa875499bfdba8623e9bdba7c9ce989cbc26110d7f1b2779e6d0d6b72d4de642bd3e20577518c48dd3e5eed76771956fc58201ccaf2df9d179

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c952e417ad651df0f300c763eb27ef8d
SHA1 54fb6cad43ea46dc2e0b9816eb8c14badca6b235
SHA256 96f677552ac4f49b77ab3d7b18a2f09328817e9f46a929ec232f69f35de096a4
SHA512 1a0ba84fe1bb5df26ccd5d9a2fe1477669d2a6aeb2c6151a8647c5fbbb3eb4d43eca9bbdfa5c70d288ff290a33b1a9940de4d493e2166b9ca5c0b94c9008c42d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ab07b92811411d06d5a643fa9f458c86
SHA1 ad1fae2f56ae67ab90ad9de06966a916e530ffb2
SHA256 d71dad1a1ee385c0f6222232ed9f37254ed2a4bd9dc074ca28de23bc0b47214e
SHA512 74f0b8080c529f6fdddf8c67ec32f7a9b1887f43a92d3f2883e169b29c766ce0f393e82c531f0869b6e3924b09a7af0d9559f0154f6f5a960c516e1dbf933f04

memory/1864-993-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f57c42d9e57fc391ef933d10518ba19c
SHA1 234a10bb2e43ebf2c2ca2acaf6df68ebe41127f7
SHA256 0af929d6292bac3dbac8da8cc368912e51c74aa56346d9555a18961377fa4ea0
SHA512 37a89cf7620771b158bbcaaebc283d547db3cf43e012daa7097b7e769a83f65f311672716590df945868df872d122a598bd71d57ad902039f2c6b9b28087fa0e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fa20ede3b1d129b907057d42ea8e9e39
SHA1 7023932143f9091cc195d8d3b0400829082af9af
SHA256 79281b76da0650b21286cedca237b50d9f613d41851b623211ccf5aa3f0db95f
SHA512 6a26b23e2b913ff76ae51b6c69bbb5775a4f9eab6c3f74b0c2f4a0d500cf52f6cff936302588ce3494aca7327003029f1fc5643bd75c896c92c05e5427efe597

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9d2be4760425b94492ab1fa0b22a9660
SHA1 79e1b02095140c14f41a349fdb08f37be71934c8
SHA256 3e2cfef02a0acd4a983a3d067b1a118a1823e6252946a19e3b1e8cedd92d4df3
SHA512 7da0436922a7a8260e3b980b5057ab71becdcf4a5ba0431b3861e690e799178a8c04692886d70d08475e1255771a60ef07b02cccd1d840e79004c2e655955814

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 181f5067dc7ce0a99e161cabdcadce77
SHA1 434a6327e6fa6707ef59c68b368a921e6e320cac
SHA256 dfc07de9c8ea9106185c4f68731b5668d108e30015bc250cda9b97e805441c93
SHA512 8701184f09175d0ce3a7033e12f17cbce0d8e899d59b06a1b6ef80dcaa075e9c7aea41ba33c39e8d3d4a4fbe7beb36d99710b7ac1edce767734fd0d91f1f8d06

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 80b24bba57b2c61cbeb29f6a8828db32
SHA1 8870e14ebe994f06e16bfa2b1db7bfb83ff387f8
SHA256 6f15f5890537e323be115d69298cd525918f276dd3a5fe2ea86169c7cc3bdbe2
SHA512 2c361cf8e61bb89642cf47186c6ae2512b727618da7ee606f6a31ec298a4aedf8eb983cd720e75039d89ecca3b1e7e433379bde67e04b144db8164009f83fd55

memory/4232-1447-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c0fb4af6f9197775e1b4a24bba10ef5e
SHA1 d3e6dbf0cc6d4281561c0dab0ccb8497ca489632
SHA256 49138fc326a3232a7a8a519ef10c5f85e4c959f53db44b0fdfefc9a0e60cc6ed
SHA512 d46948bf9b55233a5299158d4cb8c278a94a69efd864005c60b207ef93d05e684a8f96b22e41a9fb998c8cfe75f7093f5b880c7e780604074b5f68002ad80522

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 727d2aa039a7144c70ee78f9da80cba8
SHA1 3b6ad2a81aeef637ae81b5a51b38deb698ead476
SHA256 1a89d0dd2b594ff723717719e89f218aee21bcb5d950622501ed4ffefcc8d867
SHA512 759da06b0e254a658fdeb4dc63bd36b779aae960e7a70c533e648c4eecc6c5810fe217bc829784b6276fcd10defa62917f48e7bced17a48f58f6487511995b2b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 915415751c6a5013ca9a98dbfdd49c24
SHA1 554698d4a1dd25316e7a2b11b31849cad8f25f30
SHA256 9f02b1e9de8905ac854a3059528a69dffbf4901d96118dcf811121d0788726cc
SHA512 dacf6f105827c612c1fbb4050b4ff7b000f3dbe7b8fc29a53528f0219b191e59cde43bc443be3b46244e718ba931cffd62e1ba237066604d8d800eaf503ee40e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 db115e9e922136c0bf290082316554ab
SHA1 14a5ab156fbd72b5dd766927fb7d979aba65bf13
SHA256 f15b66f1570a2516ce2e5ff2a12d91f1fbafc248200eb74d7013adf50f5cc7f2
SHA512 37448791d6b85b0a7bfede11339cb5b89016b8a2c55e40d1acbbfcc1a9cdef2cf1c3bbab95ba1b4acfbd756fbe891117e217cca8b00e76833b14536ce99fd08e