Malware Analysis Report

2024-09-22 09:08

Sample ID 240722-zn8sfaxerh
Target 64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118
SHA256 f0f46eed0c64f5859af3b95bfafcbe559ac6ca27af868f32ba01927790f5f412
Tags
cybergate cyber persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0f46eed0c64f5859af3b95bfafcbe559ac6ca27af868f32ba01927790f5f412

Threat Level: Known bad

The file 64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Uses the VBS compiler for execution

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-22 20:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-22 20:52

Reported

2024-07-22 21:38

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83} C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4532 set thread context of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4532 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2480 wrote to memory of 3436 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/4532-0-0x00000000747D2000-0x00000000747D3000-memory.dmp

memory/4532-1-0x00000000747D0000-0x0000000074D81000-memory.dmp

memory/4532-2-0x00000000747D0000-0x0000000074D81000-memory.dmp

memory/2480-4-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2480-3-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2480-6-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2480-7-0x0000000000400000-0x000000000044E000-memory.dmp

memory/4532-8-0x00000000747D0000-0x0000000074D81000-memory.dmp

memory/2480-13-0x0000000024010000-0x0000000024070000-memory.dmp

memory/1460-17-0x0000000001040000-0x0000000001041000-memory.dmp

memory/1460-16-0x0000000000D80000-0x0000000000D81000-memory.dmp

memory/2480-15-0x0000000024070000-0x00000000240D0000-memory.dmp

memory/2480-72-0x0000000024070000-0x00000000240D0000-memory.dmp

memory/1460-77-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 3f85d6ada96258b4203844a721a09cac
SHA1 67e3c8c732be978b4063afa58b1af1574be50b0c
SHA256 42e052656e517d2332a499d5e39222ada138818f6aab55fb35634ed5bf98a444
SHA512 a2cc0fb3ab5a16936bac7b3659a65bbe4731c16018928295edcf92de24399bdec03a4dc10831da31badf402ec89d038e196fb29660645dfc9aee6fdfa12ac9d9

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/2480-148-0x0000000000400000-0x000000000044E000-memory.dmp

memory/3300-149-0x0000000024130000-0x0000000024190000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4baaaa32f668f756af1c1dc7446eb3aa
SHA1 b63b17160d6287fd444b0df89b5f565378baecf1
SHA256 2cddddaa45ff0478a6ac2b7fe5c0361bad160a22f933c29623a8d1c0706e920e
SHA512 6ae585ee52e613517ef162c6e45e3a27b22356cd9d4bb3e984f68a45e82980804240b625defbab3e920226bb9f34e344293c732b6a9eca7a0891339f880fb8b0

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 1fbc3ac0b29290615844239bc48b1e19
SHA1 c1013395ccfa3d8a1925867f840822fd401d338b
SHA256 0805a15e2a483cb22d167194a0dcb936ec9a7092f7c4f2d394cfa18b4370288f
SHA512 eb4d03f93c8e0e1f7746ba6e4efb73019e9912fb6f99b2f16ad08e8e51bb2a6398222a5ecccc83675bbc13ed6dccbd444faeca1682ca58d9e978e0788eae8bf0

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 f9b05e65dfa5eab88deed43d1f82d478
SHA1 d01571613b25dbf9d6b08fb0c640d779a541a938
SHA256 94ce0c752efe7c0fd3fb2a26192847f3d3f62424a172040fd08445eff0fdc6ba
SHA512 e8d653d4c62a6fda564eb4d0da328eb5817b5660dff66a1c02a0fe1b869424f824b67700e56d7defa1c3c76486cd9f56fa80e3b3b6f0d415d5f0266991a40ab8

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 3420e27847c7212dd01ded6620236c9e
SHA1 e7f56df3d1328135cb5bc7f1a1ea6ad3b3ad6765
SHA256 01f70ba735f4cf54b82c061ba3df13aec5dc1e00322f9fb61f5f726ab38b8125
SHA512 7254aaea6b50acd84395f94a0495995207d3b26ed4245b406cb3f5f830c3f68aef9c6c4842ad543e51c04eec00cf57eccec45084b2ede748de02a6a083fd2ff7

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 598dad6b9267fc7b6685418515dc71e1
SHA1 64e7708dd0095b4c4bbc9f8fd976fc09e21d4ab1
SHA256 3a627bd0547e30652546547a2bb0eea2f269c942a21369a54a2fbbe0bee91f0d
SHA512 c5e903d657601bb5648e50740d1246d1833fbc0cb8cb4b0cfad3b61fae22170f9861c2c8ade7699f6c3283a67faf8153219749b6be72300e41302543afa8deff

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d8fe358def1210477f31a46638175e30
SHA1 03fdeef10f843b1711ddcba937e42348054c2f97
SHA256 a915321a12ac79d1fa0b3171555e919495a05efbe53eadab96b4b5e7625e85ff
SHA512 ebcbd2eaa993c681f47d1a523e4bca5eecd208dcdae8c9d89ffc4d54460185b110837e357a8ead0990b3d79df674f8d07b06821c4cef3d28193638e839b13ae8

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 25eb1adba9723926d5b4fa5626c602e7
SHA1 0a8e521af3bd18fa6e45cf60775ac0bf3a0564e3
SHA256 ca14d51285290133ed38b13285859a866c91b24a3f76ef5cdf2d53b3e27193f0
SHA512 1b4096ab0739682dc7b6f0bcfa4ae7c52d43f5cce51748ce304b31c56390364b4b142d2758c28b8d50b69daaa81eb7772fb0544c807aaccac62438116a222082

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4b61dc342d68130356559d81fd99d48c
SHA1 84b205430b15cc241a032e19874ed737a77923aa
SHA256 61c7f3aa13eb454c8d2478ccd2202814356cb4076d0c955997e30c8ff5d4adc6
SHA512 61565363cbfecbbc8fe4eb03e433ba5e9379d188af11e16bc3235e6b8cfb168c7ff7f649bd7066d78016d68e1aa8eb60ab7f7bc2e2846254d3f321c29cde420b

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 be792f73bc44efcb66d5de1ac07817cc
SHA1 53d7db3baa83d3f725ee2019c7418613f82dfb94
SHA256 52646e6402337d3f1dc68812e898d0e68ae672913c6aa67532d1680ee6126eba
SHA512 2a0211d3970136caa7c15f34480c6a627ef3f1a51bc0fd54450abe17d60ce42a98cc955ae8997c6562f30ca0dedd9a37cfa7d044ec7f67c0b7ad3af4eaccad3d

memory/1460-1017-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d7a7402cf0c850e4d2a408ecd61c5091
SHA1 e219536e37ffde60f2d379c247a0c95d414e6c41
SHA256 7f4befe93931f3981312df5eb22f35e980977d06668b4883994023b2deee3a2b
SHA512 daa913c63dd12fea9a6586432a91c4da2a0427831b18390f5691736098af55d197b3cbd8bc3955cfbacd23c74475b85d2e04c7e1c02ede3e36eebe00185be600

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 ab223117bfda5d1e33e97d1c55732ced
SHA1 127f7ced6c0533c16136cfa120db62ac66b044a8
SHA256 adc77a409c5a464f029b895605c51898e9e2a40d12c632cd84da913b82fa4a74
SHA512 9149b2c8ee36339539580fa68a2c08082b6ed759035e867e5a1c7f6cc81dc69d3dfbe127ec8eeac4d48ec8d7b65f0092d5da9fad3002377da67541468848fde8

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 4fafce406b7b7b1f595a8544cf720631
SHA1 a8070e3729216e578f4611134f86f756b734263d
SHA256 d60f069aa8969e379d603840f1c900be13c6cbee6180f997e13813d0dc620817
SHA512 7dd6f947a22b1c144389b16aa17c1b35afa27e580c65b67b6e3cd78fd6b228a175e27a377a14bfc7eeea22e758ab16ada52a38030f4b6cbb2751974c24033211

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 2c560d8af7e3caef423926e95e8f4554
SHA1 44425c978786dfcc6dbb7ba699136955d335edc9
SHA256 94d1e0ce6087af9ab91c40f1a42d82c54dbc77d7e49e9330ab10eceb848360a8
SHA512 cf43f00f061e50da5e3d4c67ded749717f8c64946da1e3a087183bc7855725f70e095c91d37a4c50b29b0fc5b65ced2e5dd291efd6bf1f7dd74092eee567e08c

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 08dd70337a2a7b0015e98d8acc41eb0d
SHA1 72ec33b9e998f0c65affc23ac971e671887f7a8a
SHA256 b2a005c408a999a36760d69ed4e88a0dee51ab0e6b61c95ca60a6ed784a1a2b0
SHA512 d0824bc22adec6a66f44ac844ce314f594cb24a423a13d9fa80468c2fb96b36935b94f96e3b453b0c04e0749caaa6464cee1cbe2fdd22f2521ade338f20dee5b

memory/3300-1453-0x0000000024130000-0x0000000024190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 cbf553618491a6b89bee4ce8b24df012
SHA1 bb31b646467b92a628dacb3636c470e83725529f
SHA256 861dcf746e6699ccb746f988bf429ed9199defdafe864444ccc873972b85cfe3
SHA512 36671bd8cd1ab42d43756ece49188d89af9f773c496742d8d50e631fb441ca5866947437da16fb23327140bb2b5fb9b092d6c7d1ab5069a6b6804f57f31b0419

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 15166e4154067ed195356aa7e728f122
SHA1 0dc5bb26812331192ce98dbb9a1c95dcb1e640c4
SHA256 eba4989d407f4bf940093712cb30478a0674cfc0c8aba54f45c8c3d7bf9da80b
SHA512 ad44325d990200bb178ab16416208d16eb4a9945770245c48babc74f14606dd0eb867750baf0ca90a6e39277383e99be60ea06149e4aa82b3c213468014d0467

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 5bc9420e23e559eef94396977768796a
SHA1 431c9695a6f254b7a1faacb05dc6bfe7e0b0a918
SHA256 5af533b99f497c2096b4dc2abdd5ebb7fec015860ed4c7875abb5b6b1c47e98e
SHA512 5704d9febac8475c1450698e712a3a4a677984900f213506f82357ad42e197fc01552336595f2fc51fc2152f24662c9b7aee619ab5cc1bbb6784358c97f9439f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 793b5d6efb7c0319f9e06131ef61ff35
SHA1 9ed2cb87965658231eee03106a0fac3e4b9f5e6c
SHA256 8e20a632dcf7f7fb0fe32e5a602d2373bb62979367c93842a12ce1063f0fc9d7
SHA512 5ff85c9ec6d7d1be97bd699c0421165e4a328bc7cf7caf4ffbe302f86fcdbe91dbf16aa2916685c7d8d800ea21b7154f67516bdf07c9bff4b1549af35c6526d6

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-22 20:52

Reported

2024-07-22 21:38

Platform

win7-20240705-en

Max time kernel

148s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{826W26LF-3I22-0745-NK35-3LLBSG122M83}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2760 set thread context of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2760 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2704 wrote to memory of 1180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\64c47fdc5b4d63fef7792d57a1dfd082_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2760-0-0x0000000074B81000-0x0000000074B82000-memory.dmp

memory/2760-1-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2704-5-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-11-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2760-13-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2704-12-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2704-8-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-14-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-7-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-16-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2760-15-0x0000000074B80000-0x000000007512B000-memory.dmp

memory/2704-6-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-3-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-2-0x0000000000400000-0x000000000044E000-memory.dmp

memory/2704-4-0x0000000000400000-0x000000000044E000-memory.dmp

memory/1180-20-0x0000000002A30000-0x0000000002A31000-memory.dmp

memory/2704-19-0x0000000024010000-0x0000000024070000-memory.dmp

memory/916-300-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/916-312-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/916-540-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

MD5 3f85d6ada96258b4203844a721a09cac
SHA1 67e3c8c732be978b4063afa58b1af1574be50b0c
SHA256 42e052656e517d2332a499d5e39222ada138818f6aab55fb35634ed5bf98a444
SHA512 a2cc0fb3ab5a16936bac7b3659a65bbe4731c16018928295edcf92de24399bdec03a4dc10831da31badf402ec89d038e196fb29660645dfc9aee6fdfa12ac9d9

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2704-869-0x0000000000400000-0x000000000044E000-memory.dmp

memory/1652-870-0x0000000024130000-0x0000000024190000-memory.dmp

C:\Users\Admin\AppData\Roaming\logs.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 7e5acce0d5e255186e1876595cb0d515
SHA1 63ca3bb092f7f8b9d5b0d82304535eb5be552f5e
SHA256 308674b9b0c65fb3e403797c4b4c9009c4f47e549e01f883c439fe50b7a6e1f3
SHA512 b396aa81f9b18f79040cbf236f5b4674421c5fd17759133fdd41d2a886679bbd830d5ebfe5a8a9bcd282eaaa33abbbc7eafdfd09811af20fd03f3221fc5679e1

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 211fe23039865cc513d8733a07dd334a
SHA1 f9c3713b490231b121c5da9a5b25dd0d205b5015
SHA256 d243eb17242aa15ef1dbb112d3d5f49e9378bed334ecd1536fcc5d1ab59c6dfe
SHA512 902abc454ad8dab226d203eada105028abf92637718bd34ac0b84d3be1722ead5a19f3ea42aeed624df2f5ee5bfa22ce92682e2745d3e6e01457f76ffdc1cd24

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 dbcd7ad5d61ac6124e79739fc3eab3a9
SHA1 d9fa95d28e88d3b6f34fa9ecbda6911be5ba8719
SHA256 d1b2595282f1a03dad544ced2ed2026cd83dd28005742d9b3babae3992d7ce22
SHA512 ab30719485ac6cbbb1909b0ff19f5a9271ffffb4c8d8c54c772bb2b7792492ddae05a424cf9dd8fb98068d1311553c304ed5fe95348501d677473cd5322dfffd

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 bcbf156f289dbcc8381ccdb4321d43ff
SHA1 e7986a9980dafed1d7547ccd129bd065c7616d90
SHA256 ddbc4304cf5698fda60b87e394873bb4b37d3016477d355cb2d3cf9661351235
SHA512 5b9029501a9f6a4ffda8d06c4eb4175f2fc6d33aa6936596863392a1b96a1bd53c1981197ec3b76a1c71585cccbac8eb3be4b3a592b90b88b1999b418fe56f24

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 77fc2b0e3e55bd701ce7ef4c55a26ae4
SHA1 aaf89974e9a7a82b742bfef2217b84bffde0e735
SHA256 c3c0be7bd9ab3f2ef6d05af8ed444b11fdc7c776e78c1379aafa8984c2facbd3
SHA512 eb39932da095b9445a15e84b6ed30e94a4582484f1368aef241d5508ea5ae7799b2b60eaeb1111f33de72c330825af17756498e4e68c97394e5be9d148e5592f

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d1da74f674b4f714895dfbdfcebf0b03
SHA1 760980a8423603bf59b109ef21aadcd87b87cd37
SHA256 c045cb1ca86c8bb2e82d377d0ddcd2aaf19b8622c45617f173449570bb3de1a6
SHA512 e41a79d8a02f0b0192087e4db1dd9bd4e97d98e2e95535972858a529b005ab58fa0664b4dc2426911fdaed3e6c1c632e993b0d300bdeb69219c111441a605200

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 723943b2da59d382e8eb931528b88b6f
SHA1 1ff7b69d839a57e7da695a420a66243e73030d82
SHA256 6e8731a1f18f24a5c3699e57db3510865722e832b5a37460abac2a68c6b686c4
SHA512 0f42e16cf061faf659b18e12611f9984ee7fad84f65be768d330f4814b96c1c2418bfa710fe374641c6b1bc3249c40f0054d48398502ae5060c0b951a4ce24c2

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 df6504320e7307a684816f5eac88f5ab
SHA1 a0545ec66b44de03ae4f63541de652d52e84dae5
SHA256 0731ad225746ce26b1b08c94b1a078bcf25fe09d0c4939853f331438ad767fac
SHA512 41e5eb1ba335275552cea7d4d60e0840a29c9ec0370ba323c00739fefd28ff6727f68254a05af8e452373d19909f0db08cbca4b02cade7f60fe5002cd976ade6

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 6cdc3d3f2cd07377f130c5962930ec19
SHA1 80c3a30aa14d150851c3f2178b4f6d9ac9078865
SHA256 e83897d0d33a37fa4b5604e5c47343208b4fdc82a1e601ccecb9924c4a0bfbab
SHA512 07a82206a2f7db961c510cd1924f29bf4a05a2e6abad11158067bf15f7946ead80300c9af45b265708dd6b684a4f4e8348d3a65dd612b97d30e3f123580c4635

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 447ef357cda3bd64b873dfa23ba79bc5
SHA1 f6ba16f4894a14e6f106d8a659f5a60508ac4060
SHA256 5e9bc10433ccba6a777bec680bfba6a4a9868e50b82105f9ca0b5f8f8b75c41f
SHA512 3d85220ce2a299a97fdfc1e8a799f38f47a10e0e137f609bf3ef230766aa7792e95763b6e8ec841d07df60804fdc3b6b8a092097bb8b1bf24e2c46c22308fbf5

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d7071dfd2e9324aacdc9c58370c7f85e
SHA1 c3950419475d0be1a1c4221ddaf3ad1fd18513af
SHA256 0e1f9d7e940c1df01c5905f29c7b9fb69d56149b81b319e28b170bfb29b466fd
SHA512 189248a01396466cf20ca91de018e57c22d9b69f714df6259cfbc0acc26ee0dff834d0c9d4c297078d3cd34ac64e579acad89fe001db904759a21e5a714dc67c

memory/916-1442-0x0000000024070000-0x00000000240D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 df9baa422bf8e3a7a33a3d3902516bdd
SHA1 1a3b0dde67eb97380a29d4fb792e25d330a3dd8c
SHA256 a40623c4d2aadd4e2d9229daa2cf03467dab931a45d94012498128437e54e3e4
SHA512 9a2babab00a6f163572050d46bd954802ddb7d990dee6b16cd4d845fe3bd840723c9e3ae48806c006dab4d90f1c4cd72d349a409f69eda5083d247daebbaa192

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 de415240d664ca672c3b6b1c02598159
SHA1 e27ed8ad06a0f7e82ef8a21e735a5d40fca878f2
SHA256 df405d0f87228d23c19eaf71089117b87ba2a1d5cbb620d30e827e0e3bf342fd
SHA512 6ab8a3b6d9c9930b6d736a7b1c0753c05fc00c2a4f205c3febecad345b67e7cd479ec69f05cd49c586639be6f439244929efaf8dedab1fab4a18446de751d015

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 89d2d6248f633836a049c9f44299c9af
SHA1 d7217cc3d6184cbc0a36d19e6793048a6ab6ee74
SHA256 bca5aeebb4d595a9b14ea6f23a75f98c15889b40d57399cc9d52ce18ea2ec384
SHA512 cd3def98ec38a7276376622909de6651c523251e6832a1563167f02bc699e570fd762ccb1bb904316dee960ddb2f9a183ce31e08ca84c93b86066028c6096a67

memory/1652-1563-0x0000000024130000-0x0000000024190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 d897e51effe26e8ae35ab7fec09d6f8e
SHA1 3071cce8523269ffec8940097c7d722de488030b
SHA256 e975c78c6c16f0d3231de30650e343e4582828556955c19b1d002b5671286be9
SHA512 86de7bbea585c5240789a0ea6a8673c4fcfad7d091e92c645c3fd174d0c739bdef198dd539af35f0fe17564571371b76cf3803a2a1ea7af6214865cee9443645

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 31f1654a6f8982bde02d356538c390f3
SHA1 4b5da00d03f9d378527a2a6056317f92deeae6b3
SHA256 238026f16dce56de4e77963d8083c18e9b3dc2c9fcba9a1ab4f6b41c3a8f3349
SHA512 23baea7afd8b001b492674bdc421d3d15e05fabf5db54c4c5e9e174a524d1fcf6ea39070dd6c778232011ccd141a287e4627959e7e368fbecce1041d83e8f193

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 ecc4873512b026f9db822e06023e21ad
SHA1 53c472b9e8f7691955fe1fa33c7c447772e57c65
SHA256 4fd78119461b5a9d37c88dd5aa07d8b35bc0de90d17c3094e16ac3e718719327
SHA512 b44c9419f833c4afa7095480a7c55abe5bf284159ab7ee418d0ba711ee96aea174592cb2d00039fa714b2fee9a1a2f49c20c7abad852842916ec7f1199e17a58

C:\Users\Admin\AppData\Local\Temp\XxX.xXx

MD5 b5c135be264c92a6977720a75a227ff4
SHA1 3040fe52e26a52ec061e7625e03213d6b4a0239e
SHA256 8c87d4215d662b542ed55996b5d0e36948af23638d8c56ae08760c248b8007db
SHA512 6b2c453d239e316f410a4d5aff659b17bae4d9831266d17e0559ee92a7d5293ebeae3622439e266951de676c4e12da4eaeecc2f2faa331693ad6838c01baac68