Malware Analysis Report

2024-09-22 09:05

Sample ID 240724-b4azca1bpq
Target 69c80f46768f499acf221361564493b0_JaffaCakes118
SHA256 e102e23226e5f0a582eabae99bbc62eb10e9f419ca9e398b2a83ada385d85679
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e102e23226e5f0a582eabae99bbc62eb10e9f419ca9e398b2a83ada385d85679

Threat Level: Known bad

The file 69c80f46768f499acf221361564493b0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Uses the VBS compiler for execution

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-24 01:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-24 01:41

Reported

2024-07-24 01:46

Platform

win7-20240704-en

Max time kernel

148s

Max time network

149s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1748 set thread context of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1748 wrote to memory of 1740 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1740 wrote to memory of 1188 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1748-0-0x0000000074451000-0x0000000074452000-memory.dmp

memory/1748-1-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1748-2-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1740-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1740-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-23-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1748-22-0x0000000074450000-0x00000000749FB000-memory.dmp

memory/1740-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1740-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1188-27-0x0000000002600000-0x0000000002601000-memory.dmp

memory/1624-270-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/1624-323-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/1624-556-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 c9f582a627421801c7ed3c926bd9f65f
SHA1 e4858193005a9619e90efd3d9eb64efa58c855ed
SHA256 55ad41d15c4dbf6c287a43b10f4f0ff3ff0fbb53172ed9fe9b7291409617c2b2
SHA512 ea527acbe1774e9227c42a880559eb383ddda2d84130f0802ffd90d959b89ea6d3957d479186a76a1b9af77f8000fcb0679863a2be19840395d6f4d2b1f7f601

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/1740-887-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8795ca98399eed51738f239a0f6b1d89
SHA1 fcc13ec2d7dde265d51add1485a84ec2eec2a0f3
SHA256 4669d479b6cd081eef6248b971acb09d125e8c6baffb790600b7133af6c7b648
SHA512 c2cb1f237d085aea3d4fb08e03e7d09d6e36a0cbf151b7125887c2e0d8438689947d48242aa6391592f9e1da0f5178d3a85a43a9546db33f2643d4c877aff2ad

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1fd4ed23de4531054345e62fffb5f766
SHA1 b8d4e047abc19885bfa719a2b72736a3c6f4938a
SHA256 04172bc3c73fe9bb7d9124ad80e575d4a2479bc91c7ef8b84104424c5e5e7b3f
SHA512 fd68ea7862ce3a5958c7193ba627cf1dc1089d6f6c645a056ff03929840f9d28fa9741512c1f1ce55739d58c11f35ccd429a37af40f63fd3fbdc11a1246701f1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c708db82dcc4eb402d1e40ace9c0fd9a
SHA1 75e513458827f7e4886a475ba32bc69a054d6b64
SHA256 84533db93481990092499974390b36fe9450556ee2aaedc6e103839a197798bc
SHA512 6a44a3cbbb303147e95273a1dcf0a9a878268d77f5422fa9b5c534a244f8a66048305bf65691e95cfa5a4e368755319d92d3537cd8832b08220de3a1f72fb1a2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b864f34473bf366928664ee2e32bba96
SHA1 800a1e8be3f386d8606516b488f3c3165a7887e9
SHA256 24c917a48192608884749c1f110d56e38849fdb9d87b54c50bbc078077014390
SHA512 556724cc1d2cbe7957c4a86548be3cb11514ace538ff2a6729ce918cd49c9ee5caa32a333c33d7bb4cdb12aaece4644c9ab631bd75abf3c26e1033914234c89d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8f4f437d8df3f8d3cd65661a60abcb2b
SHA1 2bfbc07a33b01022e74a13a83ad75355f6cbef38
SHA256 f1feda5b43c06c1d5e27e8be3cf5ac3b58f0ebd3907751d85976da34d4d3bd9f
SHA512 d40ae81a5baafe7791ad84bf686bb693520ffa0a8368636dcddf7ad996000a9a2d864c436ddb784e2ad58443b34bda60764d4a06bb0e98b91bb0849ec475ce77

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c9b2dce988abb106cfe7382b9abc9cf2
SHA1 fc5012627d7ce6dde009fe1b18616b60e1b5e7ea
SHA256 3203363913c6ed4aafc31205764fcea730075e273feba1a95d4c1d155a2b20d3
SHA512 7f8004ac4ae719270dd3bf2c1d940b0503b1f0d52ba90438da1814d3b8918f0648476f5a970e9a00ea80f6cfbe12cbd9a054dcfba4637da33664c074db1bc7f9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 81a6ad4d5a79fa29a74cc58d2800dc72
SHA1 ac05f4ec34c385c402587ec86c084fcb70cb2935
SHA256 79a1589bbf646ff7bc2db0b28b96eab749a842e33418c494bb9d823e1f5bd373
SHA512 40f99010b58bbee092e8fcc7d7c3557c57eff20ea87b33b7f2c25a268eb9128bf29e46e359a8a03b3b5cec345120db2082c0958f27d2aaa1a5a92a7c2fa1647b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6dc87bef63617080910219675f8f92a3
SHA1 d0555c620a5f8b99a4d8c6fb20044d557dc6192f
SHA256 82a0ca088a81c8763efc4eb97a916202281cf84b73081eddf00fdb5c8ed885ee
SHA512 6701c60c5056379652ff87069e8943ef816f499a685f9bd3f9e14d88e3c792cb82196d27cc5a382a352d66d079d84a9109ad8fd2bdd7ff764336cf17f656c449

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 cb38b672c73c6ee4d9325c4a5834b878
SHA1 c75ad8e47e3c9264c7c5abf57dcd66926dfa18c0
SHA256 edc8a317c806b6af9813f94d031abbfe2253fdb10c0ca2e2501ec5240dea0f1b
SHA512 53699d550e75084c33bc14402016447a4211f9d74ce2a889b17cf8cb77731526d2d6c33776de2e9a77f96d25ac8eabb84136c03f3115f1633656657eac5bb06b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d9bcfbe181b2a0c6f82470be7152f14e
SHA1 407586ef9105b886f1c87ff76a53a84e605a56d0
SHA256 50c28cb54cd80d6b5b46d377156ce253ab9aecc4bf9eb71816a875f364797174
SHA512 ed0388e5c4fdaee23128e171780ddb93c2205029bf7a8a9b20984bd509efeaffb36506b9d079f60f4218eceb1f83c519b388818b1e84c53817e368a0edd1c74e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d380273fe0cdfec128a5cab5b332367e
SHA1 e7ef3cea9fef06de899a2c61b82a82e800d494bb
SHA256 e01022f8e466cb7b9d97becc908d00b8de165395b2b641924dbaf2131f48a04d
SHA512 84e7f84af0fce109ad65e320fecac0cffb137400241da1010e797dbcc96ba2591cd8dfba3117b9662d64751cfa096b8c9039447b3d5bd02319895f9a56b93b6b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e1d94d0d3a047056d554a153f56b1700
SHA1 d1edd2bd893b594cbedd9077c9e6efa7b7798585
SHA256 70f73b7fcdf8dc9177e228ce5bf7259a75771b7d77858f36362f1f5107a879b1
SHA512 83b62ade4dd02c6bd341a530789673bf37ed5f250e83d318958c0516662f407108d9cf5153f0bc6e7e88fcaf78b43a6f7db7c4768856750c3a23451fc5280061

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bd1c70a9a3c6b087065e74e3e27b7aaf
SHA1 9d0e3a8e5d7e64470ed5a1c83c3c214b673ec2bd
SHA256 c2ba3dce185ffc66abca2b14944a3de00b9ddd02956a5d602c6d345d483522fd
SHA512 79fd71c81f530145997235eb2475ad4078c601ec8533cd1b099078186cd10e6ae520597e299bb378ec13c5fcb077ccc077bb19baf31d1e63c063c98bdaeb7af3

memory/1624-1522-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5950db46e1eed8fc07ade05b8857c194
SHA1 5ff2038d795af758586093749224c703b8cb6f2d
SHA256 6edb02ab6e3d672405d15452b427fb715900b3efc39044a430d7693012875d43
SHA512 b4da9a8114853f1b2e17739f78de5cf2208dbe3f5b7bfdc8ddf549176418ee743136bbf5ba74be52eaddca871f867f5b384ed8ad31f4cc5bf82eca3ee4670057

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 492df1d5ff16bef7e60ad8854ac3f74b
SHA1 84df1dfcdfeca7b1b6b39ba53893bbf6cdbfaac9
SHA256 46c5628ea04f28dc3588d0294c6b2e43d0e00a20847b7e75219f704ec92524cb
SHA512 9aadd2d68f1e078710a5457ea5b453bf86edc125888020addd3766880b74cbe89d598617aedd24a67a25e099a81fb1187a6988e214fb6be57f11edeeac1aba55

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bcf08c511997c34a7576688dfa96bc72
SHA1 92b93be55c3932998a813222fd9f4ce8d99dcf25
SHA256 024e3860a82bcdcb29cf3f07f08f376d2204f4b049aee27d013c6d05ddcdf1de
SHA512 417235c3503752ce1e247ef3db964a337213895c1de7e9bc59b4284b6c2871d64df68735313910c9fec316a496191fda5dbb0f1bca27414fdb8b82cdef24a6cc

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 aa456b76e4fcea91f264a9ed0a8306c5
SHA1 c749a809e3568aff4a33c84408d6178918d05423
SHA256 2c666e30104ae66316ae10400d293610faebcd87a1c2676492979c13851312f5
SHA512 e8e710a3aa0c6c4e285f4aafaff994b4f84584273d1711a33b1435557d0792ec3dc0dbd5fe9bab3635fa8c6e33a0db45e84ef3e2e7c38c054766f6c3b033df98

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d334e110f06c1301b1247f12b73231e7
SHA1 336267e8bc747ba3a6993d8770e5c46c7a461221
SHA256 09fcfe9b3e71337a7b3555e493698e188194584a87d9a70d610fdfbbd44c3a28
SHA512 a15dc99c51ec51870cd489e7c6c3b11ab57db0d20694daa2dc5d8d9d3e37b603e08ccc8be4a896eb56407949994b4ad352f3cd1d0339bf05f00c0489adf40341

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18bf4cc9e468d93cdb49cc080253f6ab
SHA1 7e6d5e425dec227864db25e1ce3659161c3f8ef1
SHA256 a1d044dafbb27ab88105524bdc8790dc0961385425f029a6c4f196b2c92e959e
SHA512 8735e61d9c8818784224802865b1e6a4d30f5866735af18343a7c68584428d89ee0a28f991f555a0461cd4182e36cd6e39c007abf2e0fab6a8d97b525fa877f4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6dd5dac8df742ce07220bccd11d925c8
SHA1 cb86240ac23de0f4b34d2243baf6b090ce8a78e4
SHA256 c07fecae2040c8859382ccf5c982e5469eaad2aa592a0b566e1650282af0a469
SHA512 db32b9c933352b28deda008cc10e0ca399aa0d300162cb381415a0e6254757ca82ad9c40a9328c2b9aae1a3adc15042a6a7271ffc03e552416937663de2c8c35

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 29b4eba5b0e8feb097fc4ea454bdec0f
SHA1 81bed1ca7b9344d4ac6c221e647a6093c2b2a2e9
SHA256 b97607ee75727ce28e9252a74ae70bd0258d0711373e2defde098860a832ef0d
SHA512 cf32de695cd1f30c26d2a4f6317c2b66074bfc4f30e54f4a95c99381a9f410fb55da37c3adc5cb7049e49e3303a6340c836bd3c2b3114ca4b42d6d30ac55f40d

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-24 01:41

Reported

2024-07-24 01:46

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{HX7P0RVD-AE25-66F1-K0Y6-IWL2PC07W61V}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2056 set thread context of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2056 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 4560 wrote to memory of 3520 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\69c80f46768f499acf221361564493b0_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.111.227.14:443 tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/2056-0-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

memory/2056-1-0x0000000074FA0000-0x0000000075551000-memory.dmp

memory/2056-2-0x0000000074FA0000-0x0000000075551000-memory.dmp

memory/4560-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4560-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4560-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4560-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2056-8-0x0000000074FA0000-0x0000000075551000-memory.dmp

memory/4560-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4780-17-0x00000000011E0000-0x00000000011E1000-memory.dmp

memory/4780-16-0x0000000001120000-0x0000000001121000-memory.dmp

memory/4560-15-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4780-77-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 c9f582a627421801c7ed3c926bd9f65f
SHA1 e4858193005a9619e90efd3d9eb64efa58c855ed
SHA256 55ad41d15c4dbf6c287a43b10f4f0ff3ff0fbb53172ed9fe9b7291409617c2b2
SHA512 ea527acbe1774e9227c42a880559eb383ddda2d84130f0802ffd90d959b89ea6d3957d479186a76a1b9af77f8000fcb0679863a2be19840395d6f4d2b1f7f601

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/4560-148-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4204-149-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 50725cdf0d31685665a4331db008c0f3
SHA1 d597ad190cb90f5b30c2557d98113a587da7d892
SHA256 8ba92fe7955217679b102a87980e85277bb416a5876c7206468cd5d1b239710a
SHA512 861f6d21895568fc844962124e1b3cc9ec2b96b181e2e48f6b807fc3197962ebc6f59302854998755c75eb25c7a099ab9fb24c1e9044b1cbca2b79deda2c779e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 74bcd0a3a70b3bee654ee0a59c085e53
SHA1 f5b6c25da6a2e2ca156e9234551eb25a59e437e8
SHA256 61fe9e711a944245bd9504efb0eef0d244724d95eb4d5039769818020a715772
SHA512 877bb2c26ee8d8b003836ab8179a97e9693b970fc0021ac669741aa911527abc137ea16967a9b2b37e480b4ecda26488bcadcbe5b9e1c6385938b58ad0760bdc

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4657201f348bc36e0b337dbb67f41afd
SHA1 00f94abae6a9067875c53e9019ef1fa2c9ff8d62
SHA256 182e618087adfa5ff357290abb5f14b1b68b21cc2dee72e8c44edddbe42bf630
SHA512 0a617390baf105fffae965256be97712d1ab3a8b9554cf663d06665e1e4e19a1930ba95eebb69277fabf1e9655bd1ee78942bc4cc1551044258c20a53827b432

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ca9e790500d3a402e7a1d618038df875
SHA1 5870e21330200bbaec43ec1e4758f647d1d2bf0e
SHA256 ef2a9a4f0d8a9f9140641fdec7fc244903235f19c142c3fa72c0426d1c29be20
SHA512 6897c1a8feb1e29e65c3ad93379c147b883256bc5f02dcd046c625dd4dabd078a171140b7559244b2199a6961f920e42746f416b6141ffa70678d3089227d49d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4e8c8870363d9f87b52091194f6982f0
SHA1 c7b724e7b2e5ef183b6452dc167a753a64777e16
SHA256 15e873b77ab17a25cd5e4d9531fe9deefed05074bff329cbab124dd7a9808c0f
SHA512 5afa1647016b8089224f8c97c7e5bd7227f4d6187c298a6b8a519d4303f98f9a65948a7db50cbe52d6a92a66798107fdd89bd400700e53f24e575f049ffd90f8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 578ebdf0fa8e2a1c5a13c86301a769c1
SHA1 cb3ceb839d8926ba31d387025a6a693ef8aecf80
SHA256 bf902e226a3dafcd6565d4d355a531c04904fcc9d87dee2f15fdb63bae5f689f
SHA512 9f10e28df1b52697fa1e42bad8a9f41c28ce2ca9014bb621bcc1c4b5fd13711aa3c86ed70de3fd6760e654bdd2de0cc5f1187537ba8f9ba489f232cddc5616cf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7387a1c9c4bcacc81445b463a1b3139b
SHA1 002a695dabf11818c3db597eea9b89babc403360
SHA256 12750fe0e5a4bfe48575f044f7c1edc8893389a9221838943a429c26bb9ade95
SHA512 9db740898591264a5afdfd7448d50c82cc42c72fc519a62ee3e61be6dc35c56ed248cbf404bde24251c0cd2fea480c34e9d0719f9afc7cf10723765344efc576

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 04b19bbae9eaec699cffe2b0e19ae27d
SHA1 f2d8f5239b5c00d7a4b90bbe9a087329bf2fadd7
SHA256 57ae149b9a8a1247d9a7eabc63d3d2d888a52bd24217a0d6addb3bcb9982c073
SHA512 1541f7bedeea7a9db88334e3297e83efbb75178d321b2a0156689eb35a0443c60233739bacc16f459e2535fe2a2e43f6708d0045fe5ea329bad1467b96bf9923

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7e8a2aff4101680a283746acfb53053e
SHA1 10f29c5432a8924ebef3a69a7f485d6f73aaf48d
SHA256 8d3263071d8bf3ed3d1aea70a861c043b55468444008b08ce9bfaf3e0499e5a5
SHA512 d92a61ef01134e024bc32afa7839a273781eb170de8ae9d29bf43b3454c16bd2cc62c654916d1ef602fae8e31532cbbc0f853eb3430050f5d104977339a5bc49

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b1ae362f8c8c5bc5f0ea64336c835143
SHA1 3e3559c002f002e87bcac74ebebc67aaae623589
SHA256 6d45d72550451f3c999108c0a913c1d1e218b5d01c7510cd197e8f7537c1eedf
SHA512 801f3d8b70306f75d68a3029c47976a9c7b828be9d30b3de26803736d89e5e75f958a411c94022fae84021bd89f6118168871c9e830f73bcf64827e5eca4e46c

memory/4780-996-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4e1488c1560bdaa35835a42648fed6a4
SHA1 6c6c7ded2de0470248fd8d9682979a6a5ea8b398
SHA256 a49845a9ba6c4c8de49b4ac50e1b0809a7653413026f13caf887d3414643d816
SHA512 ed8e57bc894feb4fa7cbc509890ef21b3cb6e93da79e6633c1f6e93d57de66629c89e1b7645c8d8c5367d09b7a856afcf0ea2140fdf452a776128fda5d79fab5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bfac8dc6dcb68195c268f5dc703bd844
SHA1 600b64a5f911924e167008cbaa83ae96c71a58fd
SHA256 dd39e2d08cc3c8b16c37bb25d6e12be8582b5c77cc4d150d13c71114412216c1
SHA512 b78a0f792f1b0e2ca32181b52bd2982577fe21c1ab3ae3ad76ffd00d5be2924bc5d897f6e60826d1eeab55e23e44660886aa420aa1db3616141d100d124b930d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a44f20bcd7e51a50f4d4ceee877a4c62
SHA1 021f59beb5534581eb28894c2c1efba35ca05319
SHA256 357c9f2d464377909a1e3a72da87a20f87b5d6df76b4c6b4b0d56ac0ab7e58ff
SHA512 a74fc00878ea5637d4ff8be41d6211c3d49166d6f198f2de1a937ebf51e5875b5313a816f3b1f9387079d7ff35f4055e881f6923ff3f4fa31942c77b7950cda6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 514eb0a7cd3091e4f6eaed68ecd66aad
SHA1 d093790be27a368ac52c7409099ee4b8229c6aa3
SHA256 1d2531a50f88c93196e9ba73cbec1ff6d6fa46e3857f8a840c0491a4f0ed3920
SHA512 c2fd2f2b15a9f98ee95db792909ebb0425d9c6130bc7920c1f09ee85552c48f5c08cfbe074cb60c00ad8fd832e45cfb38ab072ee36c212af14d82264ff1bb0cb

memory/4204-1453-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 11d9369676500e44601bbb73a8201f99
SHA1 1c0d702c8f3859895aaf5ac95eeedfeb407f6355
SHA256 780af72aa299917ef717d5655e49616981d7ada357ffc806c5ef329772f10b0f
SHA512 6753f5aa4bcc6eba630c568bc197ea462aa6b24cb98da7563fd0863db26fa497d90529d2516fa694907b9b724f14f2701639e3d4439de07649c007f355a5e58a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bc73c7725e6a2081c8cd716cf24b41be
SHA1 32826c74e2424fe9d803e50f221c40d6184d1b4d
SHA256 9310efefa792c85a926011667c38ed60e0d49363bc8e14b049c62b4ab8b0e754
SHA512 a5f05e3fb7765d10a4576f50666901af4c987019674da5cd0104ddaac247dd309d6be7a613ef084279ecc0d4c680ad49aeaa13a6f867fd62ead79076e5fc8adf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 43d85ce06a9786e0d691e9c5811fe88e
SHA1 08123455ff283a92c5b7dcf1779a5692166e5495
SHA256 77b91d9d833570413d91d84074005c12a5008539cd33e503ec1a673c4913f1f0
SHA512 ea79047d2ae7f807a6978155b689b4713aea139baba7f1cbe6643a53132c62a10061c75409bf8b262bd8bf89ede86ff419c1ef394feed1b71edd32b4640c799a

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 02028a87e0ccfca03103866351717b93
SHA1 cd7a0cc5e61a517a2ac1c2520411a02409e7e979
SHA256 275c9af5d9089f74f5cbc0c63031ff9b2f0a8910ea79b4e76423c119d5583a22
SHA512 378902bb709637666a4bb42942dc56e83f007cbbd0098992cffe0fe7adbf0094b43bc5fba3dedab4a09ebb00fc2a4f86598f1daceca92e9c8f511055c75f2c19

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c9d1fbe40b324eb531c1f7bf2f6873a
SHA1 94a96a3d6c5db8a1fa4b1f8e75c2d784a9ca5cd9
SHA256 1bb3c5300199f06db18a34aafcd3191a6722cea38ea23a8dd7c0134e620ec928
SHA512 9b801675f7d8701546864d9b4ddf6105704795d67cd9d7c7b82d0aaf5672cf32f85dbf36793cc0cc275c555194b96a55beeabe9c56adc634b6b9e99c7ab1af54