Malware Analysis Report

2024-09-22 09:06

Sample ID 240725-smrzzawelr
Target 701f55b4d2e78196271782827d9337d4_JaffaCakes118
SHA256 90018ce8dbd4365fc0f100a6ccbffdf204ed8b7c559dc7403dccd39e19a45087
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

90018ce8dbd4365fc0f100a6ccbffdf204ed8b7c559dc7403dccd39e19a45087

Threat Level: Known bad

The file 701f55b4d2e78196271782827d9337d4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

UPX packed file

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-25 15:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 15:14

Reported

2024-07-25 15:25

Platform

win7-20240705-en

Max time kernel

147s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3}\StubPath = "C:\\Windows\\system32\\WinDir\\Sychost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3}\StubPath = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Sychost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 976 set thread context of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Sychost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 976 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Sychost.exe

"C:\Windows\system32\WinDir\Sychost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/976-0-0x00000000747D1000-0x00000000747D2000-memory.dmp

memory/976-1-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/976-2-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/2784-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-14-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2784-10-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2784-16-0x0000000000400000-0x0000000000451000-memory.dmp

memory/976-15-0x00000000747D0000-0x0000000074D7B000-memory.dmp

memory/1204-20-0x0000000002120000-0x0000000002121000-memory.dmp

memory/2000-263-0x00000000000A0000-0x00000000000A1000-memory.dmp

memory/2000-320-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2000-561-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\Sychost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 02b822fb535418da7f641af09d27e1a7
SHA1 8a42f48d4b9a8549856c340fc972f9c7abd16a56
SHA256 1819372c78b2057a9ca455c46afbe11157c88953404b2788ba84befd1d7730ef
SHA512 0c3821c4a5a90ad331b77fa8d6cb60b1ab47c67f491c05e11ea5f9317d657774d0a6bebc703e684c29f901cf3721430b316292a69c44089711044357b4897771

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5539db9d6933f1c53fcfc2492571fa5c
SHA1 eced43e7883907a55cb147cc6aa10f7843c5eb70
SHA256 640ffb2a394327e258ed669108c153d7d79c43b5aca2796e6244f286bef12cbf
SHA512 191e1cb2b7a3c7a997593bcc0f37a1a7d76061b8106cce16969342739e09d2b3d3cbfa58f5d88b0788190b4a13e946505a96e3e7ec76213c682649b5c17a261c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 38a4a7345044be0a3e2284255c453aef
SHA1 0518a5a142b4e84dfbaf0d7cc44538608c66e89d
SHA256 e4eb56bccef4cc76b5bf66baed23b259e7c9ce31f0eb0750319d5dfc42f12cae
SHA512 40ad71f7966fc69319d2bf75f29d18bca5b320e709c048f57a2ed775ee7565844d7928b41086b2cb2bd4c7cd395642a39d9f98b153f6caaef6aef027c86a4e7d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 23704ae131884d599596b26dd7cba61c
SHA1 cbc3461605da6856849862a47ec748b6e0bf2008
SHA256 99cbd9f8d9816ad6bf19d26aa848fa980c6ab28f9df8c7e4176de4b4e3c62dbd
SHA512 a909b94aa0c7ff7971431c68897843c54af55a964c2b462909a0c2d01eb6b5d0303743bf814cc8a29bd7490c731ef0d0da7935a6e2b124c56535693f00e20940

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 cf792a9cebff3a0e7245b19dcfe4e0fc
SHA1 40f163e07db6cd8c556cb006ed67fabbb216d3d8
SHA256 cc5fed2cd70fc94e5f32b8390bebcb606d4abad77479648d2c474a2f5475a69d
SHA512 2ced7874504637b93591714edf453a7eaf059c451add95829b478c9fca1cd7bef0ca1de5c5a3f3ef555472ef5d722c381b4ab9ca2e25c521d879d8a98ed238d3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 36684db9e60a3a61387d25c6d7c3b1c1
SHA1 337e63df1fd96c97b20388078a7a878a21a060d9
SHA256 1675863ba8eb65ac61c9238285c1a1cf91b6663bfc78ae3341bb9c241f1bf72f
SHA512 d5472219cf93208cffff6c688826ea8abeb2aad82f5272e9a7177f2ecdf646e97a7baa55ca087542cae772402ff9d31bb78d92fc081148f05dde98af38d62efd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 256d0b9644d2f5ea796f6a46b51c71ec
SHA1 69a4a01ba3d83d8f5374f7113ea617dfa4f78d19
SHA256 f47818c3181bff3959f7f94dcf52a94f8c5ed4b1484eed04a19503684f99197a
SHA512 2e02e9867b72e5f1a979ed8fd2bb75b3051f3bea74619b0f82c1f4dd6cbf498947800bc6c697a8de94b6b56935c8337238f16bc1d4c652f8a76eec5693323e90

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f9550307c3227c83e9d09d7cf16b84c3
SHA1 f98963232380f78da14a4b1160fd1ce8652075cd
SHA256 374cbfe5ada49979a5f7102ee740ca98bb6368ea3594744f2f481654f7c38936
SHA512 7f6fd668de7f5bc6129195e5ab5134d8da5453c878db11827aa101df57aff6d99e9ff25cef624e7e7c5c492bd78700de3afa606423cd7462962acf3721213a29

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8f8602faca6be030dd30e38b3fcada5b
SHA1 9a7947f16da43c71a5d0943270baa67bf7cdf607
SHA256 55fd9e50b5969f02c95b1e8ea3e1200bc7aa911517d956b7fe3584369d3e587f
SHA512 89ddf8577f7b293b17a5b8f558be7fe6a12e6c84ffd9dfdb18333e150069befe27c6218f7c947b4459d6eeeb6627a061b0e86896d899e48e0fe7562e90ee1dbf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6c03b2938300ce6f4003a03665296702
SHA1 69c1353ec4175eb5ce2dba1ed7e78c7466b2ba80
SHA256 e7ce88a941f906cfbc1d393ccd589f6eaa882b71fe71b430e880aaf19e6bf13c
SHA512 4161d5d36455e674c9b87573fca8391386ec5db5c52de331cbb264e5ea883c3f9396545b91cad5dcf03ca1e16f20d8d6f607e21b595c51d3dd2e26b73f7eecc0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3ff0a4391c30c69ac835728ea547d48a
SHA1 43e1b3f85d90e6f8ca8e0ed480b059a2bb95cd33
SHA256 aebf331a00193f5305a8e74b16901a2c465580051cd55bf0237648e162cc88ba
SHA512 815413cbdc8874afa3513634dc2442c7f9edd8fbeedd4b6a6c5aa6e5ae78183c31306f91d81da925f4c339aaf67cb7230b925cf9a51b75a856eb7502d3fe59fd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5622e8f437466cfe3f28e962ac6c7c40
SHA1 c2388b4a009c151f328e4e24e7da77a6e5dbaf4a
SHA256 881e2328e0fb763e788474ad9a0f54fb0bd70afbfc9beea1b9fc902d742ec9be
SHA512 e5766a61e4cf28b6157588488479d6889239bf4539bd274c9ff335e3cdaee474734ae9c11724549738f8c014ae165bc7200dc17a0f3dadad4d473d4bd6ea15cf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1b028e816a205f08ae798cae9bdeb3ba
SHA1 9184d77a4e91eb07b91406290efe610f66527011
SHA256 4df91ee490c13ddf487c1c20ad445a336043dcf2f8d5bb1850ed00c84a3051b2
SHA512 bd0fedb8fff3d18d2d20961edf980ddfeb8624ba5502334ddccaf4241ba2256da8a120a8c2cfa6bd1be09a9aa9ac5d0b47377810355b273146bc7328d6c6468f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f868a352660dc2b527debca6f9006e43
SHA1 1b9c4900ccd3f4e3a9ea775e5e9961697031ec68
SHA256 4ae0fa4d03e472b4c4704a5c5514d17d630403a750c67adedf4d96cb1451797e
SHA512 0b02d07c1107410db10297ee7de38b5bcba5049fe4505dc3b5173331607b0ba6766d67b8fcd0aeaceae0b84020ac0c699a3f918c45d2100622721cd41269de78

memory/2000-1552-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 588fe1d132c40257fc592b43dd652b34
SHA1 fbe07c7ff57520d78a9080e5c24cbf13b18fc944
SHA256 f4c0ec5333d6587fcdd7a7b8d0f4411fe106cffccdcf8b90219e4e698da5f50e
SHA512 3b1c984d8fa30ff82bf7f0174a3862ab79140f0d8e103ebe98414831042b4f2ff847e60318f3a0cf7da4230aa9984b4d134a6d477ead8cf4ff49a189d44c0098

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 752d065a1eea2584cd50dbe26e982447
SHA1 73a17c684fb8217efef9db08dd278f8a1995c5fb
SHA256 9e0ddb47f59fd1759e8cc22196f365449a9a922d1de00d612a928ad63243628f
SHA512 d4c38c9959299802d36322e502dd727fbade9ceb7fdec76d06545bb681d0a9f95f9002aff7f3426bf0bced639fe739e96e905d951fc1432826027de5261c31b6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 11bfd2d4040a3f8f903aea4f0c68451b
SHA1 346f70c48dcf33e1fdb23a6696afada1a423e6b4
SHA256 3edd78b0684492e75e0a0bfc41f7f84b792ccb9858e7637fb69458738b1bd908
SHA512 b1a0e21efd450229fd78e7e46b5a050b7c98d5622f841e61527550568ec94d19108f54adb1b5068b82ccbea9a3c8dbbcb6fcdeb2adc5bc6d7c7a39099517d3cd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ecdf68a337cf3c0653214f35cc07dee7
SHA1 7b13b981380084e09b0838e82c100081cb2402d8
SHA256 64b5c7bbf322d8a1fad522aaf4afd8ddfe8ac0866d583962af4832f13dda4e4c
SHA512 2bf5a4cb90c59feee4b8a2ce889285abf593e09a72e747e5c66ecfa653cfa774a6770856b749bfbd34bc26f8368ca45aa167caed6c46912b052cfd775ff54e1b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3f93f0a7d489136ec1cb98e46128de7c
SHA1 ebfa3ea231ee6305d47c73d92caa4c7e053a1f71
SHA256 ea2717262e4daf9dc65631d0e87ee213ab7cded01432535aae82afb5ceb058b7
SHA512 834d5e6422e366ec7408f6794b67f5c24cbc0444da28ae138b4db61c6961e149f9d4dda91ba86f99941815fd69b5df1f9fbd3c95399a183327f7aa83aedd5606

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 15:14

Reported

2024-07-25 15:24

Platform

win10v2004-20240709-en

Max time kernel

147s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3}\StubPath = "C:\\Windows\\system32\\WinDir\\Sychost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3}\StubPath = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6SE2L6M4-D8S4-64WC-H1VF-2BQ32F5K77B3} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Sychost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Sychost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Sychost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2364 set thread context of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Sychost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2364 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1708 wrote to memory of 3544 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\701f55b4d2e78196271782827d9337d4_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Sychost.exe

"C:\Windows\system32\WinDir\Sychost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 71.190.18.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2364-0-0x00000000753C2000-0x00000000753C3000-memory.dmp

memory/2364-1-0x00000000753C0000-0x0000000075971000-memory.dmp

memory/2364-2-0x00000000753C0000-0x0000000075971000-memory.dmp

memory/1708-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1708-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1708-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1708-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2364-8-0x00000000753C0000-0x0000000075971000-memory.dmp

memory/1708-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/3816-16-0x00000000009B0000-0x00000000009B1000-memory.dmp

memory/1708-15-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/3816-17-0x0000000000C70000-0x0000000000C71000-memory.dmp

memory/3816-30-0x0000000000210000-0x0000000000643000-memory.dmp

memory/1708-73-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\Sychost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 02b822fb535418da7f641af09d27e1a7
SHA1 8a42f48d4b9a8549856c340fc972f9c7abd16a56
SHA256 1819372c78b2057a9ca455c46afbe11157c88953404b2788ba84befd1d7730ef
SHA512 0c3821c4a5a90ad331b77fa8d6cb60b1ab47c67f491c05e11ea5f9317d657774d0a6bebc703e684c29f901cf3721430b316292a69c44089711044357b4897771

memory/1708-146-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2436-148-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 50762ce8d681736fbf830221740b1dd7
SHA1 fb991260b3bb525e7ea6b67cb6603ccc5740e51f
SHA256 a430608d5bf4781d4fb0cd845552ddf27ab03bc363c7e1aa312b980724ae416a
SHA512 0b6b68595852a8f9ab56bd2ed21fdf9d1ed122cd2241d73e611845ba7546e6c33b7279d5a446491281264bf5b984894047a6d4b4605fddc18cdf9d124e6229be

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ef0e8a082f6fd5f91cfb59bbdd325acd
SHA1 246c2c5b4b392d12d5c5bbfa0aef35faebad645d
SHA256 ae125d2982f99c3ba208a8bebcf00a17290090969b442a5192fc745cc5990a9e
SHA512 f5641e9bf71036d1c8a6ed85c218a9e1766bf5ef6daa1c021e6338664b104c896d9f1c7365fa1f070fb44b0c066ab5f7420ccd1e7e1736f3c041a292dc313737

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 128528450d492c8ef7e3f05a16c29853
SHA1 a39a7482773696ca1bce078b03af8f226d34a469
SHA256 5be58541b77a5d9e2bff46bfc28f5397ddb180e784baadfb2246034ba7e40536
SHA512 3007f3871955d6d68c1adbefcd513d1e7505b8b6110af42d0b3ed9a6046c4c5254506b497247102a2884b58dafa7df613ede1643f9ac33c229676e9294fbd5e7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 82bcd98bb6c7d5b189663ae81ea1af06
SHA1 7c2fc023803f980793566861124d2acd3a6851a0
SHA256 6d8f51c3c4effe9795a798fa871239f855ef2a41e9b67ac46724940690e09a4e
SHA512 90f638936b3fd725a317508b7f5ef480742067851bbd6012ae0ee05ffd95b2e17eb730399dbce23453ffa24348e905d77ef7822f7986ba7bc697f28c8274e411

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 912db37d25be48d4e9b9e99855401d54
SHA1 fb59ebe94a410ea30958287ccec4ab6d3fb5d16c
SHA256 e1ab5fdf81dd40ee53fb6fc468c2046cb2341a82c98c34e85a555f5407957213
SHA512 4feacad653c852f8af04429dc6cac3519cd1dcd27236a1513902a931c671a3e88712a0fb7c47d690f3e8b665938219fcf8c0e9de4905d900ea79876260349ad6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 351312f27bcbb572a6ee4070333ae370
SHA1 d730ebe5861192a83deb3c42a037af37790035b2
SHA256 368e3dcff7b855b5bbfb655d8d99e19826cd4e63dba9dfbc3b77062a088d59dd
SHA512 e0b3f475ac43885e12b7a29050849f02b51f0f1bbe9d41a1a33f7871f546ed98c1ed4b2b0bf334eaec9746c2b03ebd7a6ab058b66e7b572c7dbc6cd29fe764e6

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4e6050546f0c1264d52776880f3b4c3a
SHA1 d9dbb984526cb209805e1a67be772d52196ab791
SHA256 bc842cb38c4e09f794df08095cd6fdb581de432a0872c8820ce0e82a9551cf32
SHA512 e99f9b24f34494d54ce62d5d442a68d2413962a3411ac5cebcca7220166fef937e21cffbc74404e36df0bc5b44c530665cd156018170f2b6a6dff8a339611fcb

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 899e1b9b59403963922ae093f2982501
SHA1 20bc8215f00435d5477ae7450d0732193c99cf3a
SHA256 de48a3bcc1820e16fa97acf5aa37d1b157d9282a944fd810ad6800ebef37b48f
SHA512 493cd3fa3d5793c67a782d23dfdb0bb4110c4086786061ba63a137e5532003640aa046f61201b4774779de265fc8003a3be136a64c89bf44c86285f510702b33

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 49ac65d86aa5842bcc4bf494ca3ad82f
SHA1 70f28b61f36c5eaa80e3265e7b7ad4cdbb2c7ef2
SHA256 333100de9a59f46a6818182e744e7ce4e30bcc6b7d4a88535cb3d48ce79381c5
SHA512 55eada416ab40aec5b3c2bfeb5bfe57fa9d7838e7c4ac26a25577da45a19e3aded26abd8190ab588ed91f163ea856fcd9e409ad57a681cc8849d24e660387a9d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 44bd46ebd5cc7dc2f335563f23f9ef75
SHA1 289e8739f10716b204e355247aa3c48d48dbcb70
SHA256 3f975cf9ed2c5ecc904a0de7173795b65685b07534fe7423f286b2bac5b55469
SHA512 aa85424e8d27cecf52475bc0d80ee50c6e621d5c4ac2792d1999301691a2c626e20f5c35a3bdcc3ef47f34a023e8250858cdd6d3538e3a6c841f92093ced59cc

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 49e2e980cac33bfc6ef196fd3368d8ac
SHA1 f428f667ef9622593c93e0da1ca89631f615503b
SHA256 d52826aa05e0f901495ea58a60eb7436b59afe83b110c2db4ee916962cf50db0
SHA512 fb45e2304e10b8d97369a9a5eb08e422b545c376b36a14e4acb3914430e5c3002b30a737e8afa65441633fac86e456adc09d60da3d4cab95687ec0f12e40bb75

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9b03cd6f0fae4deabc99c7c978dbad45
SHA1 71eace1080098aea38afb23a01eb8ac8bc50c321
SHA256 fddb7dbd104b05300acb1f50f7046344bb531bbdba43854a0e8f1667a0542fe5
SHA512 b2dd01dec71970bf5c449fbce022026c5cb4baa3d0d568d88e1f3180519c1850d88244507af0573562ba895db598b2eca9123dbf888dbf93cf8fdd6cc510f848

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 efcdb671dd5036b9bc8dc59494e56007
SHA1 138ade14e4004eb80927074942675b332a1647dc
SHA256 1924c743a715a2ee166b9f061779a5c24d447c5c2bb68fd48106daa0daad6b22
SHA512 728e4cdba4780adf083b8eed30b11d75854f67493f8f9097669fc27deb6122ebc47a6b015b4f9430cf49cad43ebe33a0dae976a7fbb25ee9e4cbc8ceddd7d65f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7decf2c502411b1a4755463669533fa0
SHA1 5f09f8e326afa05007c20fe40a8d13727da65315
SHA256 c073c5556345cdea0b8ce0417f5860250e0fae4ea11819d37c5fbc0261f62995
SHA512 2abbaed20e31b529c35f8d5edb3b34ceef3f4a4cb123bb6558cda300e54e8138c2a723a008dad97d024dd25ed8ab80b4fece9277fd5ea99b03d2483ed67d2126

memory/2436-1459-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c0b393ef3188e7415d2de53e7bb4f564
SHA1 f666b5b5b84d94831ca155b2e739e7c0c1aa4995
SHA256 d5a1666d439ee81c1868f9151a44fff95a2bd7c917d6e1c143b626db060b2c6e
SHA512 a9c84547d186a372f23540347e6f3f4f269a480a9c5104a39e695188b9979c9ae1dc4491f211d1d993becf50f5c46afb883a8ab856d8100e3b138017e4f5fbea

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7f2edbfc3f34bd608c82cb09707dc1f0
SHA1 57aa21596b6775868388ecbe010b755172d63fa1
SHA256 7a053b76e189c623a2b5d86cb6f426d59a07ad6693f79572d631e7d7b1038ade
SHA512 03ec1c700eeca6d1d2891f2d86b1c83e29d02c62a5ece91bd2283b5fe02a6abbcc1d4b6c1d561f335fe3636bac08a9428dfed713b8ce45d42cb8da5ded1aeeca

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 05d080458caf399767a482e9afae1a74
SHA1 e54a36fad411ed3cb10a7c1b0957f955a585177f
SHA256 269ebcacfa83091ed512b7dc4fe5434e4f4ce9f61f8127e5f59d6ca6b4ab90ad
SHA512 8c0489cf5562d4879add905ff2965c4a2835fa0e9bfc0aa052a8b221d88a2e877804e3be374a70513fc5130dae802641803a61ceaddc6316aaef3cabbf9264b0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9ab4bdc6ab85fe2cd3b8fbc94af90a72
SHA1 5e389dc8947a84975f739572402cc54f81c1fa0f
SHA256 4d69be7360f8c8ba2d3b934decaeaf54970f9d3d1e1631cdbec6f914377053f1
SHA512 1fcdb5b0971a6fc1bf19708775e7c55e019f2bb2a792d29485f078bcacdd40d8b3dfd6ca0e54d250d39a8c6285a9e358918fccd8a99fa77d955346db7a5c81a9