Malware Analysis Report

2024-09-22 10:58

Sample ID 240625-w2rvasyajk
Target 0f15192e617500af682e60b46ccac474_JaffaCakes118
SHA256 4ca8144cfa58ff7d81803883a9337e0fd3f2091171627cbb24ae8633f489d4c8
Tags
cybergate remote persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ca8144cfa58ff7d81803883a9337e0fd3f2091171627cbb24ae8633f489d4c8

Threat Level: Known bad

The file 0f15192e617500af682e60b46ccac474_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate remote persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

UPX packed file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-25 18:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 18:25

Reported

2024-06-25 18:27

Platform

win7-20231129-en

Max time kernel

147s

Max time network

147s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q}\StubPath = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q} C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q}\StubPath = "C:\\Windows\\system32\\system32\\rundll.exe Restart" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\system32\rundll.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2140 set thread context of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2140 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 1448 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

"C:\Users\Admin\AppData\Local\Temp\vbc.exe"

C:\Windows\SysWOW64\system32\rundll.exe

"C:\Windows\system32\system32\rundll.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2140-0-0x0000000074D31000-0x0000000074D32000-memory.dmp

memory/2140-1-0x0000000074D30000-0x00000000752DB000-memory.dmp

memory/2140-2-0x0000000074D30000-0x00000000752DB000-memory.dmp

\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1448-7-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-18-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-16-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1448-13-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-12-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-11-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-10-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-9-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-8-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-19-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1448-20-0x0000000000400000-0x000000000044F000-memory.dmp

memory/2140-21-0x0000000074D30000-0x00000000752DB000-memory.dmp

memory/1368-26-0x0000000002E80000-0x0000000002E81000-memory.dmp

memory/1448-25-0x0000000010410000-0x0000000010475000-memory.dmp

memory/1360-270-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/1360-271-0x0000000000120000-0x0000000000121000-memory.dmp

memory/1360-547-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 62ea7a4e9229fec1cec508247f773a56
SHA1 230ee73293c7d1cd877e43b6b770eafb21cfac84
SHA256 ad36f8a8bb46e6a91b9ee49b5dab8d28a9605ef7fd78c7b822cba30dc218c6fc
SHA512 acc8eee197ac44cbc9a16cf669feb673dd53cda5c7be5363d1ffe188b58ff2e8402f084469e76ad854a21196d327434a2337b73b88767edb4ae9660fc84cb891

memory/1448-879-0x0000000000400000-0x000000000044F000-memory.dmp

memory/836-881-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3624b362b7901a2772ec0e3bf2f4cb9b
SHA1 a9eb13d5795171d13ffa554e80e1a5c469620ba9
SHA256 866452b21e12fb3b8bfe588f1db10af2282eae8b7789d174e450d819e2e6c3fd
SHA512 f3c3ddd575f7ac3c3a7a2da4c7afc64b36f94da57ba058931af0766a31ae886d013225fc42907d2e7a5a13930ff38a43ab9854b911831d2d34a316086b46ed0a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e8c2d84eb7c1ef0d4843cc9d243c496e
SHA1 7e41aa982a96eec0712bb1eeea7dbf32bee627c5
SHA256 a1df4ba9a2351de1e442497e55003479e0b61df69cd54ced88f52a606643d02f
SHA512 39dbeb1bd249ff583815c0bf6eb7ab4a1a73ea595edf860127c6513c5a1a0ee1a4685b68a4406758595fedc849953cf1d6b9888a5cbd91bf87954c967c6c52f4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ff0c8590a1898cd7d922ae2d39941134
SHA1 48d5c1b540f4452ed29e0dd2e8a89ddb137b602e
SHA256 665bc3b60645cd4b6e4885dd98fbc41e7b4804ebdba2e338b2254241e68061cb
SHA512 fe3dc7d86b4cb33ce08b19c71b641675d969fc9751173cf84876a6836645664a221311e764ecafba59c4e79113b2ff2cd234c8fe5bf230b6c48cb47831b31179

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 63e8d1dd73926eec5383cea69b867cfb
SHA1 3e7b90b5128c79ba5cd9ce03c79551e0a378f44d
SHA256 841df5b7931413c6416cc3dc67d3f8fc94f878df13827ad7418cb607ce0e59c2
SHA512 73a2485c5dba189df95797522d3a85a1bc137ad9dcec7de939b615eaf43ee1992668e9c403823b0c2601fa5f731a2ad24f093b88eca88117d1ef40e574011ce3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c3045555408a9e8fd6106f5a92fe76a
SHA1 7b996cf7693ee786b5a7f0ad2b72fe7c982bf0eb
SHA256 435ce8bc6145aac62d872180ca85b100a89f8188df227cb5599c245ef03b4a91
SHA512 2582115569e06c39660d5f33752d983a797be08d9ced3dc57351546ed0afff2875e0c4b9ea020be2f30673b2ca80db8efcfcd3c76a687b12a738b62461d7bd0d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c52f61433fda9ac932f601057cff3b3a
SHA1 8edbee2c663d06b8b9e570b237ba8fca220d6ed2
SHA256 ed1c33c18bac043f2e067e3c3b02b2098b01e0999f1b8a78350d0687fdf351f1
SHA512 8292caf06288e91e2d5d60153353d6666df5d298170028e80dd80dbfe844a96ea3e210a858d679049e6882d6dc7070aeeff4fd72512594a123cd427c492e6f52

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a910988bc777dd65c16bad96e136392e
SHA1 704bc0495d0e6c4b409457262f931503af8f82ed
SHA256 22aec8a6464889dee2f697252bc82e44aeb38956327fcc8e8725fd9c0c291a5a
SHA512 f94fe7ac9e3ef9bf52204a717b5038c374dd6d64c7dad39b1a1f71b3782bf041dcc624100517a6fd41996db9dae71a4857466f2695e23c4462adb61868f2fdf9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bda6f5a5969c8b9e75e67f8e6b87fe79
SHA1 b891dae55159c1b570f5cc8e6c15c71f4e7de88d
SHA256 b21759a205e720ed095806a408cd22a9287f6677802d05cdd36d043c849aaaea
SHA512 d0a483aca984a9abf55d17ed7d55eb1b28d479023d977e297d1396d4cef8f93e1738468eb81181b073b590c7210e113321500d92b27ee0ed62d4abaebfa71521

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3b5d3f03ac18414340116bf317c15797
SHA1 54f5fb4f3ce82dac443b2df3126a18756cf367c4
SHA256 616d69e332048d3a16cb1ee75ca23aa6d2e863b47684881c4e221ed0d90a4097
SHA512 b2cc48178fecee318b70b745523ad4b02134431092d83db73ef454e37a5a16a8d7308cdf3ce5e1ed7f487d9cb3118d3de415bb70e647dfc2696310e537579b91

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 40e2402894c7b0c081ed5f8c6047baf7
SHA1 738667dcf5c7cb6dab90427f11049151aa3a7274
SHA256 6ef9003d8cf04dd11834659436355fda100b9757c3bc876b36b764171e099d32
SHA512 b519961683a51302c871025873b6f390f8fd965b4d97abde759ba74a0d7d08b50cd26979ceeb6ba890172a8b60d21ec283a354667d51b36dee0fb022b2458e25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e63f3597e9646e9a0d2cf5dbbd20766d
SHA1 40ea20fe243ecc8ac252ae9fd5bdbc747eb303fa
SHA256 02dfb689077f9cf8d8a684c561f79a03f2887574b69807785a500c1e30a5c24f
SHA512 10ad33b604dbed4a6cf3393f75c0471621204f79ce8a312e0e87d350cdbda1f15536a60b3e1afe3f42899789a35e22abb1ae3784fdf58622b5f3e5e66180f3cc

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3bb533c81daf4907afefb885957ebfc6
SHA1 09a5592dffaa621011a6d1c0fea4458242010bb0
SHA256 e9dc8ce076052e566a044a7227d90df738c9c2339bfac7205151c6b8fb7b9fd8
SHA512 07a30440be1aadc8d6374402bdce25fb53ce5d6f59a93a0d5ace970b8e40fde43c83acc2da7eec95dcda85af98301d881d8af5e37757a7fb49eb01d4c8f98a22

memory/1360-1654-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 971912a6cb26be6f44fba4cd6d02c592
SHA1 16e4efb553871b844a1196d8c8ee2fa4c94695ad
SHA256 5e549bf81ab515b8d4a2e80bbb37c30a60169d7d94f9c7501283325f2d4b42b3
SHA512 edef1c674ee57acee112004446c1b54d01a8e3ccd187ef56c0f01c2b0331befccf0718b9f4aa56a9ba51311123d6e5f389d34023bfefde86de24d2c15288c572

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43c85fceab5b2584a9f3bd1325d9aac3
SHA1 b826e7b18dfcb070993c6e000521f170d713dc1f
SHA256 5f23ce06d03eda77b9ecc2407c3375b01d739eb9258faa07493b8e6e34da2b53
SHA512 642939af9cc8d7f973416a44f1517850e6e2b67b740468c5f3cc926568e8ec6eb0da73d1493a54bdf504a38bc8e048b53df1736c9af7f66cc802f58713265f4e

memory/836-1855-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2acb98c1d61dfdc89d60fec4d30ed4bf
SHA1 3d4881f8328fa096c297ad424906ee41579c8a66
SHA256 68bef596b7f464050966580a8ff364a0c2d8e369e547a75daddbc75adcdb4e9f
SHA512 43ecdee81bf294a5898510f56f116161a3f4b72db055f5a5fef0a105372d629f2c7e8a39596bfc339a71c10ddddfe0001973c2e1b8e45970fd7fb7006d912381

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7c15f9e0875ba1ea0cc74d472d9a1938
SHA1 1951fe2d994214a78ca83a614e29222be63433bf
SHA256 08de73f39739fe28d1edf26d127bcd2efb6a82bb914956ff315eaf003909a30b
SHA512 cc68ef6de827d196ed122215fe7a5b84c4331302363b875bffdd741c2736aaf2d16520ff94b90ab2bf8367105aed3ae3670ad528c102aba40c7e3f1167b84e3e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 024e3ce0103b5e8f7359bc60d8a69348
SHA1 2009698d3724ab8f50fb966aae041fe2142a0391
SHA256 5df15c71dfbc29ee90ee1bb8921a0fab5113b992d2a53a37297f6fcb62d5f062
SHA512 63543e965711c7e13c7a5668d234e99344293c60d9d52fe523f120bff2ec61ad9f5e230df3d39f4ec06d9052b46f0430d0facb33995f528e1d1a6fdca91bb785

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bf2c051a0c79f3d13efbca67eadeec3b
SHA1 a31e464c2a8b65598ff2db5c77bc33159ad5c63f
SHA256 827b8cb8ec75358c1f63a64ffbaabd4ae59921b633decb988144bc25fc3ef3c7
SHA512 290f44352ca2e277d45ac1bde0c577ac04360a5ec2a716edae1afb6ec0f378551a52d70652566f044f9311d2ab3c5e6c98bc41b535e433ae6f8416a5aed7f444

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 18:25

Reported

2024-06-25 18:27

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q} C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q}\StubPath = "C:\\Windows\\system32\\system32\\rundll.exe Restart" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{G8MO414G-F27L-S4TD-MF14-M8IF5T1S8P6Q}\StubPath = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Windows\SysWOW64\system32\rundll.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Windows\\system32\\system32\\rundll.exe" C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\rundll.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\system32\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1712 set thread context of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 1712 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\vbc.exe
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE
PID 2688 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0f15192e617500af682e60b46ccac474_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\vbc.exe

"C:\Users\Admin\AppData\Local\Temp\vbc.exe"

C:\Windows\SysWOW64\system32\rundll.exe

"C:\Windows\system32\system32\rundll.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

memory/1712-0-0x0000000074892000-0x0000000074893000-memory.dmp

memory/1712-1-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/1712-2-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2688-5-0x0000000000400000-0x000000000044F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\vbc.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/2688-10-0x0000000000400000-0x000000000044F000-memory.dmp

memory/2688-12-0x0000000000400000-0x000000000044F000-memory.dmp

memory/1712-11-0x0000000074890000-0x0000000074E41000-memory.dmp

memory/2688-9-0x0000000000400000-0x000000000044F000-memory.dmp

memory/2688-16-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3600-20-0x0000000001210000-0x0000000001211000-memory.dmp

memory/3600-21-0x00000000012D0000-0x00000000012D1000-memory.dmp

memory/2688-76-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3600-81-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 62ea7a4e9229fec1cec508247f773a56
SHA1 230ee73293c7d1cd877e43b6b770eafb21cfac84
SHA256 ad36f8a8bb46e6a91b9ee49b5dab8d28a9605ef7fd78c7b822cba30dc218c6fc
SHA512 acc8eee197ac44cbc9a16cf669feb673dd53cda5c7be5363d1ffe188b58ff2e8402f084469e76ad854a21196d327434a2337b73b88767edb4ae9660fc84cb891

memory/2688-153-0x0000000000400000-0x000000000044F000-memory.dmp

memory/3952-154-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e8c2d84eb7c1ef0d4843cc9d243c496e
SHA1 7e41aa982a96eec0712bb1eeea7dbf32bee627c5
SHA256 a1df4ba9a2351de1e442497e55003479e0b61df69cd54ced88f52a606643d02f
SHA512 39dbeb1bd249ff583815c0bf6eb7ab4a1a73ea595edf860127c6513c5a1a0ee1a4685b68a4406758595fedc849953cf1d6b9888a5cbd91bf87954c967c6c52f4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ff0c8590a1898cd7d922ae2d39941134
SHA1 48d5c1b540f4452ed29e0dd2e8a89ddb137b602e
SHA256 665bc3b60645cd4b6e4885dd98fbc41e7b4804ebdba2e338b2254241e68061cb
SHA512 fe3dc7d86b4cb33ce08b19c71b641675d969fc9751173cf84876a6836645664a221311e764ecafba59c4e79113b2ff2cd234c8fe5bf230b6c48cb47831b31179

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 63e8d1dd73926eec5383cea69b867cfb
SHA1 3e7b90b5128c79ba5cd9ce03c79551e0a378f44d
SHA256 841df5b7931413c6416cc3dc67d3f8fc94f878df13827ad7418cb607ce0e59c2
SHA512 73a2485c5dba189df95797522d3a85a1bc137ad9dcec7de939b615eaf43ee1992668e9c403823b0c2601fa5f731a2ad24f093b88eca88117d1ef40e574011ce3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c3045555408a9e8fd6106f5a92fe76a
SHA1 7b996cf7693ee786b5a7f0ad2b72fe7c982bf0eb
SHA256 435ce8bc6145aac62d872180ca85b100a89f8188df227cb5599c245ef03b4a91
SHA512 2582115569e06c39660d5f33752d983a797be08d9ced3dc57351546ed0afff2875e0c4b9ea020be2f30673b2ca80db8efcfcd3c76a687b12a738b62461d7bd0d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c52f61433fda9ac932f601057cff3b3a
SHA1 8edbee2c663d06b8b9e570b237ba8fca220d6ed2
SHA256 ed1c33c18bac043f2e067e3c3b02b2098b01e0999f1b8a78350d0687fdf351f1
SHA512 8292caf06288e91e2d5d60153353d6666df5d298170028e80dd80dbfe844a96ea3e210a858d679049e6882d6dc7070aeeff4fd72512594a123cd427c492e6f52

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a910988bc777dd65c16bad96e136392e
SHA1 704bc0495d0e6c4b409457262f931503af8f82ed
SHA256 22aec8a6464889dee2f697252bc82e44aeb38956327fcc8e8725fd9c0c291a5a
SHA512 f94fe7ac9e3ef9bf52204a717b5038c374dd6d64c7dad39b1a1f71b3782bf041dcc624100517a6fd41996db9dae71a4857466f2695e23c4462adb61868f2fdf9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bda6f5a5969c8b9e75e67f8e6b87fe79
SHA1 b891dae55159c1b570f5cc8e6c15c71f4e7de88d
SHA256 b21759a205e720ed095806a408cd22a9287f6677802d05cdd36d043c849aaaea
SHA512 d0a483aca984a9abf55d17ed7d55eb1b28d479023d977e297d1396d4cef8f93e1738468eb81181b073b590c7210e113321500d92b27ee0ed62d4abaebfa71521

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3b5d3f03ac18414340116bf317c15797
SHA1 54f5fb4f3ce82dac443b2df3126a18756cf367c4
SHA256 616d69e332048d3a16cb1ee75ca23aa6d2e863b47684881c4e221ed0d90a4097
SHA512 b2cc48178fecee318b70b745523ad4b02134431092d83db73ef454e37a5a16a8d7308cdf3ce5e1ed7f487d9cb3118d3de415bb70e647dfc2696310e537579b91

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 40e2402894c7b0c081ed5f8c6047baf7
SHA1 738667dcf5c7cb6dab90427f11049151aa3a7274
SHA256 6ef9003d8cf04dd11834659436355fda100b9757c3bc876b36b764171e099d32
SHA512 b519961683a51302c871025873b6f390f8fd965b4d97abde759ba74a0d7d08b50cd26979ceeb6ba890172a8b60d21ec283a354667d51b36dee0fb022b2458e25

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e63f3597e9646e9a0d2cf5dbbd20766d
SHA1 40ea20fe243ecc8ac252ae9fd5bdbc747eb303fa
SHA256 02dfb689077f9cf8d8a684c561f79a03f2887574b69807785a500c1e30a5c24f
SHA512 10ad33b604dbed4a6cf3393f75c0471621204f79ce8a312e0e87d350cdbda1f15536a60b3e1afe3f42899789a35e22abb1ae3784fdf58622b5f3e5e66180f3cc

memory/3600-992-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3bb533c81daf4907afefb885957ebfc6
SHA1 09a5592dffaa621011a6d1c0fea4458242010bb0
SHA256 e9dc8ce076052e566a044a7227d90df738c9c2339bfac7205151c6b8fb7b9fd8
SHA512 07a30440be1aadc8d6374402bdce25fb53ce5d6f59a93a0d5ace970b8e40fde43c83acc2da7eec95dcda85af98301d881d8af5e37757a7fb49eb01d4c8f98a22

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 971912a6cb26be6f44fba4cd6d02c592
SHA1 16e4efb553871b844a1196d8c8ee2fa4c94695ad
SHA256 5e549bf81ab515b8d4a2e80bbb37c30a60169d7d94f9c7501283325f2d4b42b3
SHA512 edef1c674ee57acee112004446c1b54d01a8e3ccd187ef56c0f01c2b0331befccf0718b9f4aa56a9ba51311123d6e5f389d34023bfefde86de24d2c15288c572

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43c85fceab5b2584a9f3bd1325d9aac3
SHA1 b826e7b18dfcb070993c6e000521f170d713dc1f
SHA256 5f23ce06d03eda77b9ecc2407c3375b01d739eb9258faa07493b8e6e34da2b53
SHA512 642939af9cc8d7f973416a44f1517850e6e2b67b740468c5f3cc926568e8ec6eb0da73d1493a54bdf504a38bc8e048b53df1736c9af7f66cc802f58713265f4e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2acb98c1d61dfdc89d60fec4d30ed4bf
SHA1 3d4881f8328fa096c297ad424906ee41579c8a66
SHA256 68bef596b7f464050966580a8ff364a0c2d8e369e547a75daddbc75adcdb4e9f
SHA512 43ecdee81bf294a5898510f56f116161a3f4b72db055f5a5fef0a105372d629f2c7e8a39596bfc339a71c10ddddfe0001973c2e1b8e45970fd7fb7006d912381

memory/3952-1446-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7c15f9e0875ba1ea0cc74d472d9a1938
SHA1 1951fe2d994214a78ca83a614e29222be63433bf
SHA256 08de73f39739fe28d1edf26d127bcd2efb6a82bb914956ff315eaf003909a30b
SHA512 cc68ef6de827d196ed122215fe7a5b84c4331302363b875bffdd741c2736aaf2d16520ff94b90ab2bf8367105aed3ae3670ad528c102aba40c7e3f1167b84e3e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 024e3ce0103b5e8f7359bc60d8a69348
SHA1 2009698d3724ab8f50fb966aae041fe2142a0391
SHA256 5df15c71dfbc29ee90ee1bb8921a0fab5113b992d2a53a37297f6fcb62d5f062
SHA512 63543e965711c7e13c7a5668d234e99344293c60d9d52fe523f120bff2ec61ad9f5e230df3d39f4ec06d9052b46f0430d0facb33995f528e1d1a6fdca91bb785

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bf2c051a0c79f3d13efbca67eadeec3b
SHA1 a31e464c2a8b65598ff2db5c77bc33159ad5c63f
SHA256 827b8cb8ec75358c1f63a64ffbaabd4ae59921b633decb988144bc25fc3ef3c7
SHA512 290f44352ca2e277d45ac1bde0c577ac04360a5ec2a716edae1afb6ec0f378551a52d70652566f044f9311d2ab3c5e6c98bc41b535e433ae6f8416a5aed7f444

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f2a07671d73f738ba861597161ab3897
SHA1 15d2e88fa53bad8f83aa78b40271740847450588
SHA256 50942c6d6fb359d82dfe6886aea583cda46dfee831428a30a06f47ad15aaf17c
SHA512 2a91d6aa30a6e22c8238a334a1bbf8bad2d5dda5e4b52b6c3895ae7a6a490a1d47c9f5d00f10e38524ccb759f069a4c95893c65582c3068d662ae94de2050862