Malware Analysis Report

2024-09-22 09:04

Sample ID 240726-cxf3fstenc
Target 7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118
SHA256 9f3b85382a30458dd7a7bbefe8efa186d8814b49f574d32d1aa70b50245960f6
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9f3b85382a30458dd7a7bbefe8efa186d8814b49f574d32d1aa70b50245960f6

Threat Level: Known bad

The file 7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Loads dropped DLL

UPX packed file

Executes dropped EXE

Uses the VBS compiler for execution

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-26 02:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 02:27

Reported

2024-07-26 02:54

Platform

win7-20240708-en

Max time kernel

149s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT}\StubPath = "C:\\Windows\\system32\\WinDir\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT}\StubPath = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System\\Services\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File created C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1868 set thread context of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\server.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1868 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2404 wrote to memory of 1240 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\server.exe

"C:\Windows\system32\WinDir\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1868-0-0x0000000074181000-0x0000000074182000-memory.dmp

memory/1868-1-0x0000000074180000-0x000000007472B000-memory.dmp

memory/1868-2-0x0000000074180000-0x000000007472B000-memory.dmp

memory/2404-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-11-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2404-22-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-24-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1868-23-0x0000000074180000-0x000000007472B000-memory.dmp

memory/2404-17-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2404-25-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1240-29-0x0000000002580000-0x0000000002581000-memory.dmp

memory/1296-334-0x0000000000310000-0x0000000000591000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 307041b0e0904eff4fe15081310bbb5c
SHA1 d545c782e7f5d6293dad78ebc14518400a27b13e
SHA256 8da63fd6fd9b9b0a90e7c5fba7818d893437c38eea1805b0c432ae672e3604de
SHA512 755ab2fceeb6b55e238f94f14715e08839244c800465cb0beb98b8f35499aa3ffcd5d586205c6827b6ab2ac510ed9bbcdc351e7f9bd16bf640f019cb5e63c619

C:\Windows\SysWOW64\WinDir\server.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2404-898-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7585b58187957d4bddcbce641af2d10d
SHA1 e4e9a4a879f1b8dc156a3423ef3a83fc23f320c0
SHA256 017aab382cab500f0d3b885b68c8dd7ae7ad14b1c471fb7293ec21e204ca5188
SHA512 81af53ff77c1733b9f8a2326baff62cf2bd74287f3a470315f78d8996e37ad311e9affdd6fb5465056f842b963ec8b036ed9f73f03b300c5ee604a6edaf3b232

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 15d511a21c97ff211926c1e5ee271092
SHA1 302e23b4f845368561f372ef9ae60fd971b7a26a
SHA256 5894eb4219d56d55f6157b3732864029528c9a5a85d6a17432172827e92d4bbb
SHA512 3fe8def8a6e657c332d85302ff12ed8888c49c2bc8ce98f10881da0f110a19ee67a971bf86946bcdbd850c26a622de1bad49f806375eea8ef76c765795b87ee2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a96f5be81213af40630442d6b049d4d3
SHA1 552e07b2b07fd784aec214767ece2253f78d9947
SHA256 99d3eec315ef0c2af7f3b590efc1786ac99d7d548f78d726bd05a1911704c4c7
SHA512 8695f5506718c00abcc70e81b6554ddc2193b7461cce734b98ac20993ba4c62466c5fefa684a7ba0f2386f1bb1029342f507ce82f8907cf673ed227ea9f9dce8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7d8c00299b5dfad7bb262801ffca0f7e
SHA1 11a35a6ed5aa2d010fb0654eda036fdef96920c3
SHA256 69c5da62ffcc9610d80c6cc7089a8d9c7afad793b8e1ce207000c3130e244c00
SHA512 11cbe24c85b11fbd2db1499b388a89de25ffa404767db5845848d6a9bb96238c1e6b74c0c47771befa249932727410e1ded3050b44c60a2942598939b148fba9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8fac07fc50a00bbf97b7a2066faf39bf
SHA1 31c4e0486c47d3a0c92e7221b2255470a398be61
SHA256 c1dc73222cce18f985dea0cf0ddbcc68c9aa0f1281e2cf0e07b3b839ac7b4567
SHA512 8ecbce6dc8a4743498d2068b158074c78ae9370131871f122ae06f9f39456a9a04b5702847c1d572b1aade0a6880d762c0f1ad901812f1400fcaac4391763007

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e3488586a00c114593b8086c79f47145
SHA1 eebb96565e79d05ce4bed0c84c412eaad0f5cf59
SHA256 19858514580e473656c615d6aaf35e8655798aa6aaa9578c7eeb8c4abcbaf1ad
SHA512 ee398462db0616fc8dc0017db3b5316f1be16c488dc5a6e67455d7ca73bcc0106a1a1c601f43f16e913962a4bcac484deb0aeea922f641d33851526e7fe59972

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b9d2507fac09fdfde97dd1e5a6f7044f
SHA1 1331282869ff12b9f81c8b764a8fd4ec10e8e119
SHA256 6d809f82c26f899874b56bee8f5eb343deb9cdb2f9a78af0088142990859324b
SHA512 8352f7e88152e4a907762fbe109a76b1bd2bdd005d1f90d212bd2fda973b65bc88935b121cc88ed785955c654847d7a204c72ee9a94cc929752d3f3379ac11f9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 19a86076cb09fa2950739c3e9e16484f
SHA1 6b8f93ee280f2fec15bac4dd387708ad5fad1a34
SHA256 1148c7221cd6ca508ff01e2a9c270d4761ce41dea0d99039302d386ea6c124f5
SHA512 bbc7d2dc8691ae94c14a23cf1049426a377d4552ccaf5b3b694117ab2bcccdf29d5eb896fa228880e2a543c39b64c4a538c96367c6622ceaa78e915af4220950

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 31cbfc984090197b0a178e788ba8d47f
SHA1 4ca16d7b49137596e183ac971bb387006a51eb3a
SHA256 7e57fafffb47be865e06d6fe944dd901d5bced7b37da63a77758bbe2322480dd
SHA512 61ebe62779216e3e575def2789c51bb8a554d8d7af253a230a43207afda314a5f04f6209f67bc4d20e949a796bd53612a3094d8638d159f6e0b4f590d4a93a3f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 76719d10e0bd6671ed44ed075f6056d6
SHA1 08e8803adbbb1135dca867274be6199811acd280
SHA256 eae7abf86047e8e4f42bd6bdb6d12153c90504490bb89163b3f6154b2a13d8fb
SHA512 d2f875b5fb7a7043d6a286119cce653ab0c24a912d5658a59564681a516a027db33fc972f2d4c813ef53329ae075369178e97ec17b4f9be7c5bc641b091bbad7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 996be824a30180bab01f6b2274b5db4b
SHA1 f6ed1d1c971331c3f7c17d16df261ade02e6053d
SHA256 bbf66321646dc21a4193f4162b52099dd8a310a4b6506e5f842d2e8f84caeb61
SHA512 affdcd6b2f30b02bdcd4959af62c122075dc62e6e4db59e61ddeb6084c7a80ee181b78a90590ec613a36a557e678743da09ffab1f6ad738e06e4548c5301563c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7a884f880a80bfc7f7538550925e7147
SHA1 ded4dbae27a9ea1716652892978e4a9507c649e5
SHA256 01d2d65b34ac7e311e52bfb5384805fb9297fabd1756b56069e6c25957319897
SHA512 ede06668001a23c627ee978e6d71ecb378a0d17c51a74f6470fa2cc34e62e1a45763210d2ce1f22ee57c80efae7b85973a39d75a6a245315f1383e0976716618

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fdee61dfb3f814bce39103aca779b2ae
SHA1 8d4f1761de5099a1299435f04adc1dc4091f21f0
SHA256 71f1eddc4de3da044ec78c9bca1149006c9a54370ad4797cbf9db50dc0b46970
SHA512 ac7c024b0f39700743785d4fabf8700e37f7a216e5294e5577ececf323e831f6b5f19e55cb4600562629070ddafc0164c7b5b705d1d2b23d082fbd28f622e25d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3368067650c383e33be52d81210c7faf
SHA1 d0cdf01fb4bbc893be1ef9b1c7bcf526a2724ff7
SHA256 8fd7b1fc9ab794ba9d458010a36c2d00e3df537c8184fb885aea74768dee9e79
SHA512 8ce2163dd27fdec2e1fe255b1d4a97543dcc33af1f52ad961e5a932206bc6efbc7c67cc1987b518cb1612a3690cafcf9ecc3d60f0148ef704d7181efba4ff211

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e2a9d1159b231b4ee0ccdee3059e288b
SHA1 e5df463655dcabb8ddbe2bbccb6155c3316fd7b7
SHA256 49af7257d1c2dfcf215678f482b155478797a6380d99f831fbdd6b1d55a6cf39
SHA512 5fab949c80b176a0599a4523fd7f78cf080cc894fa809a9aca54f10668e7bd0d26c49ca049f476fd1e210291f7210f9a8085f6a7033f2b4cb6e5975151151169

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8548ca65b2bac695ac6b90f56fa93f07
SHA1 af193aca07211e29d14b16f127057801d6aab59e
SHA256 745fa96d9e8a765fde03bc3f379bcda11adae681c1b9ff9f5f220c76ee9d0889
SHA512 54c1ade64fbfd8cc81aaff271156402053180d107fa1e1164b36414968a02e478fe70af96ebbc9e2568ae35cfc1763fc7822f6abb777a41fbbc39b820cb58598

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 24960189a7af4ba70d26c64a1223cf56
SHA1 897747301899c5ad19d51f56a520e7c585d489dc
SHA256 27bc457287b177073c8b3f694a6e902f9baac4d88ba99ea7034fd6ba40252906
SHA512 50015baa68b503305be1822ec48fbc602916721272ee682becfe6d60342d0bd3fb59762aae87ceaf16969062fa97138c175a539ccf36c49fc57f9375b681e3ed

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 396d3182e89aa70df0a8bf142b94e786
SHA1 06c09b353b62476987de97d5a8a15b5511c49c88
SHA256 3a0fffc1fcbc984dc792fdf74f5d7418327cc5a7bd1004fbee99f4b1f5f25c10
SHA512 f1856f0af935fc670f558f0a85794c0ea49858510e5ff85064e93372fab95f10428a0234d791dfc6f0d50ea372dfed6eb29662897d8060941d1cdedfe0e67e07

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c30e655375f6aa22181d1ff26597f16
SHA1 fd5b15607091cece439970104af8c6496e8ce5c8
SHA256 ca74eaf3bcbd3117109d966fdbf8fb056f7fdbbde36dfd4205052f4b397a73a3
SHA512 81f6d9e7bd845408fed6f79f6f676fb28ba80c91f445b00a2a7e870d819de79d24ff010c500ab497eb856c9072779a47fe76326b08c7d69692688355289871e7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 88da58a83b2e84de3794b380bce91dfc
SHA1 b458355570aecca624eacef34b4e4c35a7af2243
SHA256 ea3a272f8f126fa1abf2fcddb79dfbc86819b1066fdd22e9340f7978c64121de
SHA512 13d2605853ce1761bc5864c3880fadf59e45f3d0da9334358ef9923b91f4fff8607f9dca8c2591769bdc083703fe60cf6ec1c54ba112d6fb68140b455370b048

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 02:27

Reported

2024-07-26 03:02

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT}\StubPath = "C:\\Windows\\system32\\WinDir\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT}\StubPath = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{NY3FV504-3S46-65O0-726Q-1C2BODCRC3QT} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System\\Services\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4652 set thread context of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\server.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 4652 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 640 wrote to memory of 3424 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7240322cbe365e6b61cfcc3537a5f32c_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\server.exe

"C:\Windows\system32\WinDir\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/4652-0-0x0000000074D12000-0x0000000074D13000-memory.dmp

memory/4652-1-0x0000000074D10000-0x00000000752C1000-memory.dmp

memory/4652-2-0x0000000074D10000-0x00000000752C1000-memory.dmp

memory/640-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/640-6-0x0000000000400000-0x0000000000451000-memory.dmp

memory/640-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/640-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4652-10-0x0000000074D10000-0x00000000752C1000-memory.dmp

memory/640-14-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4720-19-0x0000000000C90000-0x0000000000C91000-memory.dmp

memory/640-17-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4720-18-0x0000000000590000-0x0000000000591000-memory.dmp

memory/4720-79-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 307041b0e0904eff4fe15081310bbb5c
SHA1 d545c782e7f5d6293dad78ebc14518400a27b13e
SHA256 8da63fd6fd9b9b0a90e7c5fba7818d893437c38eea1805b0c432ae672e3604de
SHA512 755ab2fceeb6b55e238f94f14715e08839244c800465cb0beb98b8f35499aa3ffcd5d586205c6827b6ab2ac510ed9bbcdc351e7f9bd16bf640f019cb5e63c619

C:\Windows\SysWOW64\WinDir\server.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/640-149-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1576-151-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4275ac515687a0dd28421dd16d6e9197
SHA1 63be0a30c8d5d3f1ddf20297fd1925b81792a9be
SHA256 b754d4098184cebb73412ebb0cf79df00b13fa1171ed70f007ae165fdee4b6fd
SHA512 32f78e6d32ae64d7cd0c2aa1bbf925fe8f05fe063ab680aa4cd4e141b41c6eec8b5f4599413db5351373190ac54d83bc5074756c1c76bf3f3fc637a3a3ef20bf

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c23aec940144876cf4a76ec470fff090
SHA1 85530d187e3df653b59ae576fb0ff134eabe47b0
SHA256 15fc4edccb7d9f0eaab4b5c0e22b655f897a61b38b6e2c97f9143d27ac33de71
SHA512 03ceacc41fbb9160c71cfa8c196a7467294e31ad0aa9e199dbcf093f9f28408a55402555ca28754bfefe91efafca2962780ca263d86984ae58d13adb751788b8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bd5a2ea815b7206f3188bf87fc1b0dd5
SHA1 d988958b9d8f36e4b618e189526e5cbc78f8e52d
SHA256 18b13a912012aca6fd7f15052dfa141417645fac7b019a1be3259071ade7205d
SHA512 c18b103e101ad948fc280fbfe626d8cba852807292c80f98b0f7ccc3dbcf16a471b3286a4aa06919e4b1f8773dc5fb29cf0cc741234eb487bc9b49ae0b4d8e75

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 75a50b88f455d0e8746ae4e8e82e0462
SHA1 c749524ccd7cdddc78acbb980113d396e160ba89
SHA256 0ef04915a9814453b634918787bdfe7115686bfdca2754a009d7523f695789ac
SHA512 05c3ee509067b7d28cc697bd81010ac037d69a9cb6c10ffac15495c0fce3c6760fa4b7afdcd485d4889dd71aab80a69b3d724d7da9e7b9156b0c71ada8dfcf68

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 72717f2a5b0e61157b6094ebcdc96c7e
SHA1 038e8751f02928f3cfeec0dc5bc21e6a21e75813
SHA256 b1a7fe550a272c8e5dc9f20ec4191bc0d4faa41b0af0426fb7e4836a9145c557
SHA512 593abd6a7a4079b0565fc0d45c507cb8716e9f519220b528eff591590f2294a9ba8cf6aee44f874c63e5ea4b9e4dd3f136ea40d6c315b99b36f7ffb8b7024c66

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 055f7f52dfc2543dcdd78e670daaf283
SHA1 4182aaaade0d473652396f28d1094b5091137888
SHA256 766e9e8401d31a02c6bbfe8a18f98da37754f9150a697d2d6127b71b0ee1a984
SHA512 53a702d94474a6745008e3de9353cc5cbea1b3eab6650fb3a0623210a15392616fa1e411ab4cc3380986dca8fb1a5b976d265dfb8620027d75f2dc31eab51c9d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7e639008e122ae73a78ef39da877c022
SHA1 f62fd5324f032695e70e15165e79a355452f52d4
SHA256 30cd3ddf54fd0a49b24ff4855118c874a31d8213b7b7c586d7171183e63ba464
SHA512 1a2c0a010c116ad225fcf00a5ebb608191aa2279fe86bb4a5870b468cf7f2a7bc477c5275d5f62ba9bfc54a8a94a9ec3963228e73e6992fd9732e90ad7d9d05e

memory/4720-772-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 9c638c0360c0561c565ee8978f755b40
SHA1 8ff3c7df592d83ba7b47586b2493ab68fdd85e91
SHA256 faf0c2724ecd9fce9f01dacd809b53ace4223671b9bd767526a672b9d52fe42a
SHA512 2046420f67ffe33677e7ee61b0d5ad8fd640ebbf066de9fe1b1101ace2be3397e448e4ae9dcf274cd1c3f6305bddd67f002f9426def755e020d38e96085dc653

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f338825558484d685ae83d3a0ef904f4
SHA1 669413695f3ce5b609a1ef0a43bb3b5562cfeeb3
SHA256 d2c5458253ab1ef361230aff45cea393273c65bd286a4d214f93fdc587592344
SHA512 1abfaf535a740056aa4d920cd6b0c0c35ef880b98867a5e476af174c3007c143d3d07fbf5054a2e381b19623e9dee1cae15216ef14d66efb0b2e8e56af5dba42

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 acd950e7f44888f2a29df9fa9b4d3e0c
SHA1 81b77004139a5d91d460f08f7110773ab68cca5d
SHA256 86678f11826bf1c04e3d71e120afe6c75d892453e203916b74e711b21c0ef7a7
SHA512 8ce0d859d1fe3272e66eea0fd8b253deeadd426f12745e1d3d6399888ee715d0cd151e522a6136109266e451081d33e1b105107d02cc74c887c105cf12e920aa

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5a38a8d64836493a392608372730424d
SHA1 06dd0c35eb3676e0dba5eccd6b9d9266e9b401fe
SHA256 f7d13963217c56838d12f9c3172dcaedfae2b235e630c84971565e590d55f9d0
SHA512 067cd3e1262c4b089e4ccb587a8ad8376652c5b4ba70979a8fa3e725dc62a690480f1382aa1e33ede1ff33e120abdc3de8478214de955e4da01ce525ce44509c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bf45cca0483a91dd70fd8ee6ac1100df
SHA1 788d8dec57a5724fc6ceb4d311e583952a9ed82f
SHA256 e8c20c602d8b1bb36f037da905da0649c3884e11aefcefecb614dbb39b01f5e2
SHA512 0098c383b3b0783d4d838f82c3f527a6c0c795349726c2c92b50ea1547d0169693b9180f5c28fdd0cfd2231f546f87c7c4ad958ad76861a8b7b90973f7a6e9ae

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8b5e9bd78c9aa438afd00812a2cc0093
SHA1 4fed7046ee6a90bf323c659bd54831e043c56c6d
SHA256 55273c50114281123350452a4738324893e7cb89cdaf9df75089928f018935ba
SHA512 130038a286f70d88fe406167fbf78e287dac7b46fb6eb3d6733d72cc2719f83d9895c6ed0f59349ed342d4656814b6a5fbaa69b92b6107bebe8921306965251d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d5ef0978c2b69c8f422393793ec9b067
SHA1 25729381bc57c144f2df1c08cd867a5fd0dea9b9
SHA256 741c4b5ed1314f86518797661f6e836ff768205c802e74ca8f46d6aec3654c56
SHA512 7ce5c30e0abac6e7b2314eb633d118b5e141a35672ee7759dc2e35a191a8435e9d23951042ea88f7f89b7a27521d7fe0c7061f5371f6a95f05ddb8c841106095

memory/1576-1460-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3a4fb200391a6aaddc898d5f4e5abe50
SHA1 2b01d76d669b7195bc695fc12a3e04019ced683e
SHA256 1775173a5ac0a90a38dbd25ea3ec429c2647c7c8644f00a1cde504dbdefc5964
SHA512 c3d418bf409d4dde31ee6e9cdf66397a3229df4482905705811165b909d3ec6ccea8ed5133f53f66e0eb1301811402da30f98d6ba47eec15dac27af32a837200

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 405b7a2caf3cdabf5f799058c1508d1b
SHA1 74458732954fcb0f46b35d84367dde38b6342fea
SHA256 45bfb21cded3b8e8f44b398991ca292cce9613bbaefe9ec8657f1377ccd62ca2
SHA512 35a8db85f013ea90fd3aa265583b49524bd1db703439bd6caa9951e4b6b40e64733f7778cb64a9dc72efee8237ddd62a3e7743b847e0d2de98230c03ef6ba3f8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 65b6191e6b454123731cf94b7737c897
SHA1 0a2dd56d2a0613e3678a33f22b7df925468a8d99
SHA256 eeeda6419879616e3b83b224b708330f5e3d0c2436bd874d0d2c39c714190bf3
SHA512 df1fda319063fdefe035b773565286ee8df47f20b1cb32fff383f1fc52b2014717cfa7c91dd8e0e3a29ffac10c71178c676e14d1169e27042dbc797421800802

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7243fcb69ed3b6667e5206080163f233
SHA1 a66383ffe989063d699ab4e718334d1cccbe2434
SHA256 343d9ef295aa5255feecad772de786d5b2c44d45a79510d8c3a67dbdfc9b9ef3
SHA512 bf8cb50912318e73397bcc5f46291b43e4e78e9434bf5479908cbb0a659bc4d1c1220720c83d6d071333c63a6a763b6be995f07893cc66f37e5ae85880008f54