Malware Analysis Report

2024-09-22 09:05

Sample ID 240722-z3llfsycqb
Target 64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118
SHA256 33d1e3df5d208445164053583bc302842b65a192655ff115ead3890c5156eeb6
Tags
cybergate cyber persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

33d1e3df5d208445164053583bc302842b65a192655ff115ead3890c5156eeb6

Threat Level: Known bad

The file 64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

Uses the VBS compiler for execution

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-22 21:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-22 21:14

Reported

2024-07-22 22:02

Platform

win7-20240704-en

Max time kernel

148s

Max time network

148s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2976 set thread context of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2976 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2316 wrote to memory of 1208 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\svchost.exe

"C:\Windows\system32\WinDir\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2976-0-0x0000000074441000-0x0000000074442000-memory.dmp

memory/2976-1-0x0000000074440000-0x00000000749EB000-memory.dmp

memory/2976-2-0x0000000074440000-0x00000000749EB000-memory.dmp

memory/2316-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2316-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-14-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2316-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2976-16-0x0000000074440000-0x00000000749EB000-memory.dmp

memory/1208-20-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

C:\Windows\SysWOW64\WinDir\svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 21b70ff91971ed271ea427f145e79bcd
SHA1 fa109706e017169637330c599e44453ab6955435
SHA256 b3fb948c9e8a2864ba1ccdd663c0246091da36cd6025d6204a730bced50b652c
SHA512 03e0503b1cc6ccf41536da22acddd85ce34de5e7d1f2f1bcd3a79d9b76b7b64a9e53522f5d699a14c5fb1dd2ba646a4a8564a9a4fd2130ca7f9fb44dd25696b1

memory/1660-551-0x00000000002C0000-0x0000000000541000-memory.dmp

memory/2316-881-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 87a51201222195209a9085eccfcf653f
SHA1 ea4f16bb2b2bed4035be99dab2f869a0d5efbc15
SHA256 454a8552f5a77e01701b256032a5ddf20d45e5f3aaf45dc56ebfc1562b67a8fb
SHA512 8692d3c1b99264e6fb5859d1a1e4a723b4538dc4a93cdd8ff7ecf3cc77a187f9daf28cdf318d6e5179d718b5d8174e063622efd7a0dae0b8580bfc347c06ccf0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09ca9bad05dd1e4ca85da573af37f4c9
SHA1 f5e52b6ff39c56e64005c66470f68d7081be6a5d
SHA256 1cea38e28d268356f6a06ddd3e4c45d193405edd00356820c6cd7854b2646ece
SHA512 0d45e8598261ff7cc588ee408d5a073d784087fcd0ba89d3986e2dfbf38691a742a92d7efc0760b252c07890a3fac19f69738f6c26cb15c02aef87789457c664

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 558965f3a26002fda11ef65b9fcec31b
SHA1 0780b1ce937d81a232360a8eeba303accf3b4f05
SHA256 1adf63bdcc51d8140606079014c6dbbcebf794948e6f56f7b9fa8f1f28d37914
SHA512 cd2c267523d23fed0f918fb7629e427e07c1e46f7336f8a99f264cf21a2a404f6618bd832d3f3191d9bffe101c86a8817aa0f004b7d5c2d4e6c65b3e93fa75b4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6f4cc58573130ca6db3942c13e4c6a67
SHA1 0eaa55ac9a06c8f5c35791dcb9a2f433794bd60b
SHA256 dedc3ca6ee299b73e769c3ade0f3255b0066df223d3bb1022f085644699185a7
SHA512 980235b5e9dc1d9d06d53d824e0bc4a79850364390eb1b0e12fc14f588ed81911fc2ba2945f1a842ec45e7b91158e3ac42ff971ff3d683d6414d5b057c12018b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43eb145bacdeca45c6b90ad37493a487
SHA1 ccfc4e7840e5e183a6647d7e44905e1ae780694f
SHA256 b3e14d9f91b64027f59bce32e3805b4413fd6c24c9835d0a53f985484f8e66bd
SHA512 9f7f196f31eff6d26228c947a6eaa6125dd31ea6fb21a0221e9a4e216bbbf5883f5f60e05716e1147ef1e8665d8b3f1b1fb9782c338a51f5cc695f5f0b40b944

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 655f0795a2e858b75877d4f4c12a986e
SHA1 6405c03767b63520f17a6901f68e0f56581f9886
SHA256 c19c193ac052f96b935a13b6d465ee5dfa733f4d776fd5e4437c1b2a97743c5c
SHA512 afab06f56ede6113ac557e05f2557b5517da39a303e889ced00fd59037c6accfd7e036370dd1bb2d14a8297f8f3bd1954d19ea7ef2b99c9305225fbf4c8cd07e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 df49bbcf2aee2eced20620b52faac117
SHA1 cd04d278208b12cd5081b776327cbc1c708609b1
SHA256 579f4a5b3e32e7ac1d0bda8471e166f868899edb5aca8cf746c80d482f36cd87
SHA512 968ac7ce4acb799982ea6d2b2af2160a65ae3893f5242159fa64739c6b2b1acad4f1fe5a0465eca5350424bd6a33a5be4f6e043c0af10d20357a9071424a2d35

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 05581d56f06b1fb3e63892f03410a05d
SHA1 e210cb85d551583774e94407324af98d66226f43
SHA256 6b281d4ff49c287ff35271f23f1e49d72c914ce22ae6de56c6c1f43d66c42925
SHA512 db15e10ae681387e2ec997a2240a2ba976ade7a3d19345390258e0f70ad468e5e7cfbb15966a4b2978f7108dac1e248745c8a527dd4f86e3aabd51e9492540d2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b9d89ad9808246a7c8a7bd6d79255e46
SHA1 7719db3a2fee7f25b671f91fca43dd27006aedb9
SHA256 fad8dd62b469a432fac34a53659e878c8f1c3c3299f6c5a9af5fa4513a8e2d85
SHA512 69c51389144d9cd50f1bc57c91987a0b9d6b3fa816151a4276e13318b7c8f9eb98ce8342f8c3320becc2c9868f8e5b503694c64d7d159263795d1e95a6a6852c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c4393114dd3e51eeeb7978a406ab6b47
SHA1 ee2180629d1030a4c630cf5ee2ff018652f52153
SHA256 9b1d337263866d5bd7c9645c996af68bd986428ece4e8ad47cec9575c76ca2cd
SHA512 4b9c32a5e105e352b464268785c961981e324d008d6f9747f2676abaa293a32ba76ad3109499aaafbf4604afe01fde66b811cbe8dde97a89cb0a9c643134444b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43dd2449caffb2b374d57f5e1cf6fb55
SHA1 b3a7664633b35591087c64310fbe5f70d5d3bd99
SHA256 910fb941f6aef46ecb7754d52a830f30d0c9ccf21cc18fe18c493cdc671c3753
SHA512 cf779adf8b934fe14e3ee64ee55e82d53614c3f112547bbc496f2283562fa5ceefc8af0ec499b4d51fd9affa919a0dae755ba828a557579019668289d4afba78

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3df1b9beaf63d7448861684726c94f5a
SHA1 ed1221f644d068e2659f431e22dcd756d07c8807
SHA256 5ddca14d3b2ea257d9b8987c687620c11e6b594dad14048bd989abaee18796a1
SHA512 23f1c42f214bb29b7deabc121c5e0f4bb44df34170c20873c3813152afd530ab3172659e64ee8ca4c1ad1ac36d394380c37c7e20aabff676f3f8f207a16cb11b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3142fa1a281841974f08f362ecbee87c
SHA1 f8c1033fc9a0f2a2f6471113991685466c87da95
SHA256 d807bfefd8ca48f9ddee1cc02e203fe6c8cf0fcca89b7dfb6abd797e14a88270
SHA512 cd7b0bda0071064e04106bc25784e66826c347acf4f5deeb4d25c863ddaad024bf90f7bf9139f71ede5c657335e024ed77dbf1ab7cf8290da82bbde35bc214ff

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bde798da1c9b836bd4044faa758938cd
SHA1 01e7025445b36e532d3c5b483536e965587ee855
SHA256 c395cbe66db8b424df2db956b707aa0eb10ef4774922baeda515a4ccfbd59c4c
SHA512 ab3d0f0c0cf8e82fca065539f579c682e82981fa9e9bb756a45c14fd8418ed270ed298d96fd9056866c017a2c2a648d43afabea3ecf31e5aab87a9347b90e4d0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8e7b1b032cb8ca6681888e7a4a5b989a
SHA1 f01b3dc6a139d750ce0503767bc6cc71f49b0379
SHA256 bf0261554e8f497d5c9c98082d9243861672a0838e2bdac69f97468d89258823
SHA512 938625413d3d839c5513ef9b118aa75443609980ed5b13a13da854a9d719d2ea5e4a3bd7a23151722e42d0045e3786ef5c671124fd664ad7a3427bdf9323b2ca

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d3412a296dbaa91cdeb68b30ee15687d
SHA1 86615199c52cab6a40174ebdb3c593505766208b
SHA256 d3ed829d50505e41d08f1cde8c3a4a50ecf3bbcd010bd97aff16f96761122770
SHA512 708321b3bd7a2ae9d372af4f1247f9e98e030188a4bfdcba4717b7451fd20cdd77d88f80e8ddc5a0ae0dcc93aa4995e86639434d25ef675ead1878102ed3eb32

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 132125ce1da9f40738fe3c595d5adbf3
SHA1 8b1aa437b301d8834ee9d329ac0407d5e023174b
SHA256 6aa4dbe4db9a2ca3b97d4b402716901ca1827bf312673c5d4b3ef3a3e220dd99
SHA512 e31077eb691104b9d65dcec017d461988faabe89ee5f9821ae93affaeada47fa853b3ae9e0d90231258cad40632eb2d9710e1b4f2dd279b33545ef79874b408b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a81b23a0bf4b7bd9a9eb71030298a8cb
SHA1 896d9a3b3549d85b30ea69a72401ec0b06e8e51c
SHA256 9d862ea34abef2ad973bec75ceb0ba6a8925a8ad606214e9af5732069360f0fc
SHA512 7d57aa2bc893ea8ab66a5af50373d56a6e85cef544067e415220f1a89025063ca7430ab667c15bdf5f523ab30017bb9ce33d5109c4da76048f2e7e9597dbd3aa

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-22 21:14

Reported

2024-07-22 22:02

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24DX367Y-K0B7-7481-N83T-72B6HN1S5J44}\StubPath = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3008 set thread context of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3008 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1048 wrote to memory of 3420 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64d4adbd2b34c0cbcdf01ecf62c3fa2d_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\svchost.exe

"C:\Windows\system32\WinDir\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
SE 192.229.221.95:80 tcp

Files

memory/3008-0-0x0000000074DB2000-0x0000000074DB3000-memory.dmp

memory/3008-1-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/3008-2-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/1048-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1048-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1048-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1048-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3008-8-0x0000000074DB0000-0x0000000075361000-memory.dmp

memory/1048-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3044-16-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

memory/3044-17-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

memory/1048-72-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3044-77-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 21b70ff91971ed271ea427f145e79bcd
SHA1 fa109706e017169637330c599e44453ab6955435
SHA256 b3fb948c9e8a2864ba1ccdd663c0246091da36cd6025d6204a730bced50b652c
SHA512 03e0503b1cc6ccf41536da22acddd85ce34de5e7d1f2f1bcd3a79d9b76b7b64a9e53522f5d699a14c5fb1dd2ba646a4a8564a9a4fd2130ca7f9fb44dd25696b1

C:\Windows\SysWOW64\WinDir\svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/1048-148-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bb6082fbb308cdda84067a4acbbc5135
SHA1 990ceb0ef2658cdfc99add1134629070a4c636ef
SHA256 753c3dbbb97c997a255379ed23547fc5e5734a6c209b38d5c17be00629d59082
SHA512 fb511bcf03cf6688507187ff3dad9297c4b8ecc5067e343fd59ad95f247b9159945cff3a5d7491e4bcd11cf036119f6cb53f3aa4601df03a7b5b4b9608c3f3f4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 31250135f369f90770d3607b3564f106
SHA1 af1e732670fec78428547f6f6e3bb9c745f6bd33
SHA256 402a5359ece204e5f35b65363349ac640b43b47368f3bca44f5130b73dfc8e59
SHA512 2820b332db121e70a6cc84ee00f246567a1c56eef18eaefc40958cdd5ef8545445f418f67c0f8bb323ac7df817405a2a998c292f883c99455f4d02922dd79924

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f7dcb38ded5b849eb014627de67a5682
SHA1 7ffc5626e611f8e71531373d26c2ea8898718a8f
SHA256 e29efef867e37c082959d95dfc291bdcc8571bc1906a7764796d1453cf6d5b58
SHA512 88f9632e3ee57e51f618390600e491b35ab54f90eb3f8d7d0eefaee1b81817f1fbf446d76165bf773b2dec4750d60d5b3c84c5e42ec0d4c487c5f5c2ad59b49d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 40bb745234c730e6c52d5a62eb372877
SHA1 06f96b5ff7657a77174e57d2418d61cf2a5f864e
SHA256 a7bb1dca3783fb3c2b7ca59617b57aaa2b5b7334d33f195ad80ebb0bf316abfe
SHA512 5d3927640a3d87424d6d289e6fb85204c6bb4e41b08adfb80ab72c6bc67950da4332bb917f9958461c59aa9b68979c1cbea7bfe696f670b7b0fe33c3686897c8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5888fb324afdef9c2ee65f96ffd1fdf7
SHA1 bf3d3159df08a97da7e40ab44da008f0aea13339
SHA256 422ec02185ef93d3aded7943635b48bc112366655366c405469883e69dab2918
SHA512 9edced1fc152ac07cf973e71a749958fe376b99f545ea63d5af852f2ac9678c159a9ae0d3febf667012531378c15e1cffb1949a9755e540622002481bd5d5e8e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d93c48b2ba66145848e2c2fb7cd1439d
SHA1 b1c722fef50e0da472016c7571a5562842ef9935
SHA256 5bfb0e0e86948b7ac3bf10d4135923baa2e82bd6747eeb4da66d07f781e82459
SHA512 78749ecc78e33477d1b7b47929fc27a6e194e7128d757715e6e8dcd391732cddcdf541b088319c7f698573735f33092560e465a9959c70a45cbc3fea8f748cc4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f77466f93ffdd8d3d2ad1ba27e4ed9c7
SHA1 58d91cd007551375fe8d1243a72512da989c0a70
SHA256 fa0b05e30ccfa0e450b5d7724278d72abc61d91ecd00596bc02a5984eb2a15b1
SHA512 45496b11ad0ae3f3e7e9394764e18fda151459360cf2210218126453bcea3bfa5a066f310e54c60e0d49928301645532b8673904e667ff7760486919d047f374

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0c5ebe18147429a6c5e2435ca319b155
SHA1 fa1ddc609fb29f3c2819156b29839709f2419971
SHA256 294e3349e850fe8adb749f27067a48be1c3299b55a6e9b67fa678b11646728ae
SHA512 4b7f7064b874b0ace92d2ff733f7e97d7a8c951ff2f8b0c01303ab82f1b3281a6501c8d3875565d0de44a39387eef230174280cfe4358e0d82b49190c54dcdde

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 452509519286e62cc39615cdad05c1e4
SHA1 b61dcbe04aff749d1ba25372c98205109ca730a4
SHA256 8260017dcbd11ae88810fc783ce5fcfeaca171a6371d84f6e987071a24575ffb
SHA512 21215236c1fffe513b16762d7e77bd8289363e91f07bc77bebaa43989fdc9482c40be24250cd14679e01c2288ad8e6cfd4feed5c0c9e0a0751577b31f57406ef

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 69f4848aa1aa50d9fb3d3d8cdb18101d
SHA1 b7d084e92561e1efe2a3d008844fe17951e7668d
SHA256 6811115320ea47b37ca7412237875bd1521845357be185cdb0cf6bf37753cbe7
SHA512 3655b1a916d3e3dddb2a3733370729407658fefeadf482611313f238f14c29a6ebfbbee88955364f9952e5710c84f804757ab9af43d65a1712d9ea12038156d3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 abed6c9fe5622de3c3e2c30f7fe89d91
SHA1 26a4c0e19b903b3e0f8bf28f488bdd18c86db290
SHA256 e67183d2cadf2d06f9fe3cf9518c63a3de9889f3c8699e6632d7295068599a32
SHA512 b45e6049804c8ee0001c698f09b905b86143432395ddf503cce7e7692e7ab89ac093b9222bf8c9e47d74176acc05e4bbf1e41dfc5adb82350f9ebb64de6f3fc2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c5e3c9256f0e7b315e30ff06654fc3af
SHA1 e009bc6b5caa173d43c6155e2d59054318e9f909
SHA256 5e25eeddb6f1c5352c7240d74de5be6bf86bc173c9317bff2c764ce25f21e110
SHA512 7d40c634c38fc658746952325b358db7060d9585ad1969c750641ae70b9f3979702125d25f8113afdcaca08da4e8f7b4c441e31eea54c96804ab7a47ff9810ac

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 497482a8a11845d9a64fc9ffb78ea0cc
SHA1 60690adebf6df3796316eacd6c2b9dcac38783a9
SHA256 cd1acaa11f065383b385661790b181fc120cba48986a7504341580c080c38134
SHA512 9a8f22761b08d9d60e501db3063f61b4f2029143f7e3ed1a9b6955967c2b1a3f29d454e5b99df935cde0612118efa91bc03a110795821fe3bd410b1c90605fce

memory/3044-1340-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 87a51201222195209a9085eccfcf653f
SHA1 ea4f16bb2b2bed4035be99dab2f869a0d5efbc15
SHA256 454a8552f5a77e01701b256032a5ddf20d45e5f3aaf45dc56ebfc1562b67a8fb
SHA512 8692d3c1b99264e6fb5859d1a1e4a723b4538dc4a93cdd8ff7ecf3cc77a187f9daf28cdf318d6e5179d718b5d8174e063622efd7a0dae0b8580bfc347c06ccf0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09ca9bad05dd1e4ca85da573af37f4c9
SHA1 f5e52b6ff39c56e64005c66470f68d7081be6a5d
SHA256 1cea38e28d268356f6a06ddd3e4c45d193405edd00356820c6cd7854b2646ece
SHA512 0d45e8598261ff7cc588ee408d5a073d784087fcd0ba89d3986e2dfbf38691a742a92d7efc0760b252c07890a3fac19f69738f6c26cb15c02aef87789457c664

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 558965f3a26002fda11ef65b9fcec31b
SHA1 0780b1ce937d81a232360a8eeba303accf3b4f05
SHA256 1adf63bdcc51d8140606079014c6dbbcebf794948e6f56f7b9fa8f1f28d37914
SHA512 cd2c267523d23fed0f918fb7629e427e07c1e46f7336f8a99f264cf21a2a404f6618bd832d3f3191d9bffe101c86a8817aa0f004b7d5c2d4e6c65b3e93fa75b4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6f4cc58573130ca6db3942c13e4c6a67
SHA1 0eaa55ac9a06c8f5c35791dcb9a2f433794bd60b
SHA256 dedc3ca6ee299b73e769c3ade0f3255b0066df223d3bb1022f085644699185a7
SHA512 980235b5e9dc1d9d06d53d824e0bc4a79850364390eb1b0e12fc14f588ed81911fc2ba2945f1a842ec45e7b91158e3ac42ff971ff3d683d6414d5b057c12018b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43eb145bacdeca45c6b90ad37493a487
SHA1 ccfc4e7840e5e183a6647d7e44905e1ae780694f
SHA256 b3e14d9f91b64027f59bce32e3805b4413fd6c24c9835d0a53f985484f8e66bd
SHA512 9f7f196f31eff6d26228c947a6eaa6125dd31ea6fb21a0221e9a4e216bbbf5883f5f60e05716e1147ef1e8665d8b3f1b1fb9782c338a51f5cc695f5f0b40b944

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 655f0795a2e858b75877d4f4c12a986e
SHA1 6405c03767b63520f17a6901f68e0f56581f9886
SHA256 c19c193ac052f96b935a13b6d465ee5dfa733f4d776fd5e4437c1b2a97743c5c
SHA512 afab06f56ede6113ac557e05f2557b5517da39a303e889ced00fd59037c6accfd7e036370dd1bb2d14a8297f8f3bd1954d19ea7ef2b99c9305225fbf4c8cd07e