Malware Analysis Report

2025-01-02 13:06

Sample ID 240702-rnqymazhpk
Target 1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118
SHA256 9d8057458886e42a857a0e30955d7d8d89f3db58610bdcb91b7bb03843c3441c
Tags
cybergate noviembre 2010 persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9d8057458886e42a857a0e30955d7d8d89f3db58610bdcb91b7bb03843c3441c

Threat Level: Known bad

The file 1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate noviembre 2010 persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 14:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 14:20

Reported

2024-07-02 14:23

Platform

win7-20240220-en

Max time kernel

146s

Max time network

120s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winnephi = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winnephi = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ} C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ}\StubPath = "C:\\Windows\\system32\\install\\root.exe Restart" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ}\StubPath = "C:\\Windows\\system32\\install\\root.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 2016 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 1692 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 mixbyte242.no-ip.biz udp

Files

memory/2016-0-0x0000000000400000-0x0000000000411000-memory.dmp

memory/1692-3-0x0000000000400000-0x000000000043F000-memory.dmp

memory/1692-6-0x0000000000400000-0x000000000043F000-memory.dmp

memory/2016-5-0x0000000000400000-0x0000000000411000-memory.dmp

memory/1692-7-0x0000000000400000-0x000000000043F000-memory.dmp

memory/1196-12-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

memory/1692-11-0x0000000024010000-0x000000002404E000-memory.dmp

memory/1692-8-0x0000000000400000-0x000000000043F000-memory.dmp

memory/1692-189-0x0000000000400000-0x000000000043F000-memory.dmp

memory/2300-200-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2300-251-0x0000000000120000-0x0000000000121000-memory.dmp

C:\Windows\SysWOW64\install\root.exe

MD5 1f9d057e24d345f7ad3f0cd408fec6e3
SHA1 3a88962a31168d5d04c2ef5daf81558ce624a695
SHA256 9d8057458886e42a857a0e30955d7d8d89f3db58610bdcb91b7bb03843c3441c
SHA512 8a756e10125185e3e8ef22080b75bd94bea0c7b58f3da594520549d7cc6778f7cdd324d136885042d2c27a3cd4b541f1c20eedc585cd4fb716a0b43eead11e4c

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 f0dc08e2a78ad1213ed23bf087a86acb
SHA1 2a806cc648703bcd1753404b30f73ce4a1ec1bb1
SHA256 9a45669290cf184df5734dffdb81c501d312928ed4fc9cbf6374373965963a7e
SHA512 c7eef0c0ae9775d0d41c715244e3bbdf04b43c344c1122f0d969ebfd404c2f02583321da1ae973e995fc946e31697d6b332dee57784072b4b87b2d447ac00683

memory/2300-414-0x0000000024050000-0x000000002408E000-memory.dmp

memory/1692-436-0x0000000000220000-0x0000000000231000-memory.dmp

memory/1692-676-0x0000000000400000-0x000000000043F000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 86f3c87caff4d7973404ff22c664505b
SHA1 245bc19c345bc8e73645cd35f5af640bc489da19
SHA256 e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA512 0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

memory/2628-695-0x00000000240D0000-0x000000002410E000-memory.dmp

memory/2628-716-0x0000000000400000-0x0000000000411000-memory.dmp

memory/2628-717-0x00000000240D0000-0x000000002410E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 14:20

Reported

2024-07-02 14:23

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winnephi = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winnephi = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ} C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ}\StubPath = "C:\\Windows\\system32\\install\\root.exe Restart" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1V7485T0-MF36-Y2E6-341Y-7X3IR2DTIPKQ}\StubPath = "C:\\Windows\\system32\\install\\root.exe" C:\Windows\SysWOW64\explorer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\root.exe" C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\root.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\install\ C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3264 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3468 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1f9d057e24d345f7ad3f0cd408fec6e3_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 mixbyte242.no-ip.biz udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 34.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp
US 8.8.8.8:53 mixbyte.no-ip.biz udp

Files

memory/3264-0-0x0000000000400000-0x0000000000411000-memory.dmp

memory/3468-3-0x0000000000400000-0x000000000043F000-memory.dmp

memory/3468-5-0x0000000000400000-0x000000000043F000-memory.dmp

memory/3468-6-0x0000000000400000-0x000000000043F000-memory.dmp

memory/3468-11-0x0000000024010000-0x000000002404E000-memory.dmp

memory/3264-9-0x0000000000400000-0x0000000000411000-memory.dmp

memory/3468-12-0x0000000024010000-0x000000002404E000-memory.dmp

memory/3468-8-0x0000000000400000-0x000000000043F000-memory.dmp

memory/1564-17-0x0000000000470000-0x0000000000471000-memory.dmp

memory/1564-16-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/3468-15-0x0000000024050000-0x000000002408E000-memory.dmp

memory/1564-63-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

memory/3468-60-0x0000000024050000-0x000000002408E000-memory.dmp

memory/1564-65-0x0000000024050000-0x000000002408E000-memory.dmp

memory/1564-64-0x0000000024050000-0x000000002408E000-memory.dmp

C:\Windows\SysWOW64\install\root.exe

MD5 1f9d057e24d345f7ad3f0cd408fec6e3
SHA1 3a88962a31168d5d04c2ef5daf81558ce624a695
SHA256 9d8057458886e42a857a0e30955d7d8d89f3db58610bdcb91b7bb03843c3441c
SHA512 8a756e10125185e3e8ef22080b75bd94bea0c7b58f3da594520549d7cc6778f7cdd324d136885042d2c27a3cd4b541f1c20eedc585cd4fb716a0b43eead11e4c

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 f0dc08e2a78ad1213ed23bf087a86acb
SHA1 2a806cc648703bcd1753404b30f73ce4a1ec1bb1
SHA256 9a45669290cf184df5734dffdb81c501d312928ed4fc9cbf6374373965963a7e
SHA512 c7eef0c0ae9775d0d41c715244e3bbdf04b43c344c1122f0d969ebfd404c2f02583321da1ae973e995fc946e31697d6b332dee57784072b4b87b2d447ac00683

memory/3468-69-0x0000000024090000-0x00000000240CE000-memory.dmp

memory/3468-72-0x00000000240D0000-0x000000002410E000-memory.dmp

memory/3468-124-0x0000000000400000-0x000000000043F000-memory.dmp

memory/4584-127-0x00000000240D0000-0x000000002410E000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 86f3c87caff4d7973404ff22c664505b
SHA1 245bc19c345bc8e73645cd35f5af640bc489da19
SHA256 e8ab966478c22925527b58b0a7c3d89e430690cbdabb44d501744e0ad0ac9ddb
SHA512 0940c4b339640f60f1a21fc9e4e958bf84f0e668f33a9b24d483d1e6bfcf35eca45335afee1d3b7ff6fd091b2e395c151af8af3300e154d3ea3fdb2b73872024

C:\Users\Admin\AppData\Local\Temp\UuU.uUu

MD5 97d440d6e9b13677dfd9ef3c214a39b6
SHA1 dab31125a8a8852c057ca5a081f2206b75dc7df8
SHA256 6eb10a20e74cbcda8aecc5a73725c9b6e69f6cc73be884908ae264765b667449
SHA512 ce061a3d595c1760f944f71a589a0ecf70b5eb82ceb6a17e6324e1754040d88ffa981996504402b34ecf5ec6f18ed19741707028b3a7a5076495bfa68c904894

memory/1564-162-0x0000000024050000-0x000000002408E000-memory.dmp

memory/4584-163-0x0000000000400000-0x0000000000411000-memory.dmp

memory/4584-172-0x00000000240D0000-0x000000002410E000-memory.dmp