Malware Analysis Report

2024-09-22 09:07

Sample ID 240726-dnzzmswdka
Target 726044aff9998f412c0545a66edeed7e_JaffaCakes118
SHA256 84b792f95d0b24ec3b0b9274f9d5eac0f14b3af95ee67ab5a00339acc324940e
Tags
cybergate cyber discovery persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84b792f95d0b24ec3b0b9274f9d5eac0f14b3af95ee67ab5a00339acc324940e

Threat Level: Known bad

The file 726044aff9998f412c0545a66edeed7e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate cyber discovery persistence stealer trojan upx

CyberGate, Rebhip

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Uses the VBS compiler for execution

UPX packed file

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-07-26 03:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 03:09

Reported

2024-07-26 03:52

Platform

win7-20240708-en

Max time kernel

148s

Max time network

150s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1452 set thread context of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1452 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 1948 wrote to memory of 1204 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1452-0-0x00000000743B1000-0x00000000743B2000-memory.dmp

memory/1452-1-0x00000000743B0000-0x000000007495B000-memory.dmp

memory/1452-2-0x00000000743B0000-0x000000007495B000-memory.dmp

memory/1948-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-20-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-21-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-19-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1948-22-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-12-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-9-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-7-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-15-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1948-13-0x0000000000400000-0x0000000000451000-memory.dmp

memory/1452-23-0x00000000743B0000-0x000000007495B000-memory.dmp

memory/1204-27-0x0000000002D70000-0x0000000002D71000-memory.dmp

memory/316-271-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/316-324-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/316-554-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 6202f7a0bc51b0b2ad72cf7a071cc419
SHA1 aa961408a5ab2ef25d48fbfddf9524f4c524a788
SHA256 6348c65ace9a2243ebc4caece3159e3b631402ebe3a8604057a95e78354076b8
SHA512 5a4285c87b6f4527c301eba8807f4926250ad19d716410c0798a354557aab77cce0af09c2f8c5f9a6da42ce20408a31bb45f197337de8ac9976e3eb5be84e89d

memory/1948-885-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0c8a23b3f5e68c56972f62f99e7c8943
SHA1 bc5df80aa7308af305300b06ff149f830c21a84a
SHA256 573bbb98641c1e6bec0e5429653abd54df069c7da1b93b7785ab98a69fdb9c36
SHA512 fa9dea06799432974357d390191ab18f6e2013ecc3308133f49328ffd7aa546419d19cf524658cf7a469bebfc75c55269b83dfb69e0545d36c24eb5209ac3aff

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 691f8f016bfe6a716210a0c967fcbb97
SHA1 4473e2c8a0e849cc7da70aada7f053f2d1ab1fdc
SHA256 76d7af1dbb6c1680ea6b9ecaea660bfad148880dfc889d156bd20d106bd40d70
SHA512 99928418f8faf3881c8dc3aaef1e47edabe27ed4b29dd2d6ce51e57e46607fd5faa44cbbeb82cce646aef7005fb1c06038eabe970bc88e0bdeb0cc9e4e413049

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8a6e7630fbad3ebeddcb28a1c6b2aea1
SHA1 ac3dce064b03ae9f2f2bfba9c1cc9132744ed24f
SHA256 32d026983dc0bdfc37e0c69e4dd9ec10b6d71eb750bc1596b338b597e8da42f0
SHA512 17671ba9c9ffe229b99fe6f318b48ae882a256b60d4f04216f68f55d37ff77b56fdafd91de5a88ff2c2d26030c3f007c76d5021bc6aefe9d184e9f2073cc14ec

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 00721c3380f117d974ee36ec57ea5559
SHA1 807c1046dd05afd02b8f7b7acc758bda5dabe663
SHA256 698f75b28626f26fdfb5d0824a6dddda6aeb7169164fd2144637c574f8542f3e
SHA512 d86cdd561636d28f1888c5bf8ac5edff97274d432b3376d846c3487a4fb86b1d4e8960f7d0510164b742311f26241c42bef7062adc31189f4b9fbba4cef4fb68

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e176d6b6f69f082f48c66a981731b133
SHA1 74b294109ebebff9743a66ae08f53660a77d6c0e
SHA256 e319d35ac972d6955707d35b4f36c0fc5e7e79f60cbc3b0c53ceb195b5a263fa
SHA512 829f43e0f14d9746d6085388d93400c36abaf06db4e2f83418149af00d85b6cf9f9a3854ef4240fd4a43fdf815e97b7761c4f90c9042cc02bc28969a5d4d2996

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8bba2151e476f2e95cd46fe1d83a7165
SHA1 180e581eb50dec2fb351a4ff11ad5496dd5cb332
SHA256 2c02d11b1583eaabbf75e12f7cb0b5bd61388c9a1682f5aab0cbc9ac5f9c9da2
SHA512 b75fa223d0a443a1bbe35fbc9ad3c62ed48860d25de31632aee8f947821c4caf6d4baa81e28c9b197c000fe58795b8b6ec06900c1778522285fbbd719fcf85f2

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0f481cae508f52e1ae60bffa44279e0a
SHA1 8f71aa1d45ce8a11e71701e7d6d757c94229ccbb
SHA256 e2087db784de7e3716883cf00d6eb21ce2e534e0be2c3ef980839a529adc1a77
SHA512 eea7cde98afba7b4d494a94c994323843e15d861c0c5599f1a5eba8190d9592cb5f98a522c67d257b404b84c1196593e1a32e215fb9c2579ac83af6f9d3a8bc3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5b98889724482e7064c2b7ef5d46e2d5
SHA1 7c44655e68cd2b8fd94f295a06b97937f85cd3f2
SHA256 a6480f67ed918c5eec9ef169f456226d02c306ea7b5609b8b15161a5b6ab9dc5
SHA512 bd0592a1d7815fe7e5619a6bb7d51e9f2fadb2bfb216c44befda6ddcedf29056f36f4bdc830209f43a2ef978f1aab7144506b7553a160d05aebf96777a3fdd65

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 a2daafc32390b375366888348b763508
SHA1 40191b6e2c3752d9be89646d76a98af3e9cc8543
SHA256 d3d3a70b0262be4857db351c87a14fbee58f1e5807b8ed554b1a0ab457dede7f
SHA512 229e1691a76ac51a162de8238d45a36503dfcf7f24c0eb7e8d748c1feb5179f88c9c88a2ade80bfade6101b99e1d15121dcb46b4f4cba4c1faa113c1eb324117

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d5234611b3f3e2f3ade8165f4a5bbaad
SHA1 eaa12fdef3014cc0d711c76046756dfb5d9349cf
SHA256 ba1702ebb3fb921db4f3618a232b84930144938bbdc35670501ca4266ee5efc2
SHA512 c5cfd20481ab5e5f0516504b4c648ad499cd1ccf5a06c833f4a5113a4e943fde676d1562c782b4445da324d23d9f724b7fc64ab907a60f149988eb5f86b809f4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2cb59ab65850760b5ff0119acdd3753e
SHA1 8d1af075794a7975bf9d7a5d8f395599db8fecdc
SHA256 e4f6cd5bce131efb29b620db6d5b19a2e0e49e1f04b23ddfd9a25d28632ad1eb
SHA512 b1502179a9f7e2a801da453c8aae2524ff706e7efee75e5e5cb46abc99d789a1010fb9e3ec9861e566acdb6df409921b5cdca8b93bb5443667fde32dfcf865c3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2ef343bb1df24b541d82d9029695e8a0
SHA1 295d93ee60dd04dfc477b8d48916732451b267f9
SHA256 d7824045a8c7dcaebefeec3f59446ecea456e2ce629a5b3b1b9ccaf8d4dcae64
SHA512 c74944bb8c119a9e90b33e9ca8600f335c9bfab746bc53afa9b6eca785984907945fcf98de396d20e418a848c579230cc2e18dcecd749c2d1b7597b2eb93f214

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 759bbc682b4c56b174ee5bf8b29c28e2
SHA1 cccba5dbbb4ea8682e9d53d170e3c6c7fe4b4805
SHA256 cce1db6e4c78a31ffb39006e685b08f2720d00bae5bf329041d7c9a6fa5c94f7
SHA512 9bb4bdbb0fabef20e0d97085e83f14d3bb4afc349687fbe6c93d644fb9527d014d857fb2a7d0d5f36be2f9e542ac336d06e50f44328236f5e8cf56f890d2ebf0

memory/316-1525-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 833d9e0cdf329bed344d0961bc07a5a7
SHA1 2994e142ed6dbec65c483b08e93aa126360b1c17
SHA256 fbe4d53e400ede46e1c2c2af12f034747fe6ae2d8a1d4f33179c4dec9f497544
SHA512 8c5e30eb08bf5e0263944c03f4e0c0925bcb75f6b5c900aba4f0642be3369f4073b992b807c1c837f3db769c4688c00e982f655cecd0536ffee57db5b055c138

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 954d3648d6c818ed361ea30304276460
SHA1 a202a81f02cf38494d14d699ea44b9b759c9fea4
SHA256 fca50d050dbbfe6913d21d903dd09dc7a69dc6f3113d089c5d7f675887ef9eee
SHA512 0358e7d4a677a9de30100bdbfdf737c401c8801e08c6b0431f9569c466202d3d3e0b02b2a7c1853544693ec4869bd5adebfef62ac364861e6bb14abf279c921f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 1d978bde050209f70af99a4d14751fbf
SHA1 f1c22b888a4e93c58f260915d9d82486a9bd45e8
SHA256 e407c946f667f62993d38285d8422732c3dedc3283906fef6679d65d70537756
SHA512 9e438f2ca2bb17bde89e29a5f3ffbe8c4e6adcf33b7c7c935f71bfddc6ea2cf4cd1326b55da8b85fefb88928641981fce33cd55fba07ca4f77628ae4c0309347

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 71d40bb5cfd3f5e8df3c1affeefd50ae
SHA1 ee1bc86f913048237617c3d5a6603a951c307449
SHA256 0d091bffe6182a34f811b43b457e3ccfb6dc7fd7dc5f4a113681421a7e5462e2
SHA512 8e1406420eb7a1a2f80030948ef60b5617a95cdc3314986dcbc9114fdba5024babefb4064b43a66d5ec7944890fed8f9f47b7966538d61961a85bdf34080a6d7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4c32245fed0d4237ae4e4be69d8a64a8
SHA1 e95f639c9cc7cf29ca579ad89a4da8f969239765
SHA256 d6746a0e0f1d9351a4b46439af9823c7ee30276ed6dd236e4e4653b1e88f6a8d
SHA512 4cf00c740363a484855013c687948727b0647b2598caf8ee61ec71b6fa63a0ff286a7d5a8e00cfcaa52c15572ba8591df745a57e08acb7156688a663c4ae8474

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e8d6acbd9dd999b7b0a980f7255d16aa
SHA1 22dd7aeb0bc07917792f90f7126826fde63add8c
SHA256 ea9d965786c874182c9470b16e4f71b67b4ab0af9ab0cf93002922ba300a442e
SHA512 e2d93cf9f206f0a3d3d337e4418efb515ac6a334249ac499d337d8d6f532b3443c84367609c3d9e43a5e8fef43f07ae2c6a58908d530cfba6115e14c69330570

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0ef69ab9f8b40a6f58506ccb7dcd74bd
SHA1 c79809431f5c75be8affa1db35d79ff4cb86295b
SHA256 ccc02ea3371fbd234a45ef67c654255db6e281d54d2519a51acf16158c5691b2
SHA512 618f3f32ccac458cbcef0fca55e8152764ae7a0316505aa5e11c1bb7b29edf7e1c76cb92c27d0c95f15ac8013fc0580cf26ae1dd24e42f9581029e994828b9b5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7e4af1444462535fc4add488055a82f8
SHA1 eba789c8b76dd832d98e892b5d2e04d7b5e9641c
SHA256 63a83a0524df88add6549bb860bdb521357e143d4c0ce4422261983cd3ff2a55
SHA512 de53c5c2b841f7f324d6dd5c8c543b94f180a937352dd3bd00dc135091494cd9c0021f62dbf42be1d23d4e2ca2c44c6aad5b74e7ac62772efa675093e6500593

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 03:09

Reported

2024-07-26 03:49

Platform

win10v2004-20240709-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI} C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{N8XQBNGL-D00W-W0E5-57AQ-VM2MRLI058WI}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WinDir\Svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\WinDir\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3504 set thread context of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WinDir\Svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 3504 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE
PID 2080 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\726044aff9998f412c0545a66edeed7e_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Windows\SysWOW64\WinDir\Svchost.exe

"C:\Windows\system32\WinDir\Svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 106.246.116.51.in-addr.arpa udp

Files

memory/3504-0-0x00000000750D2000-0x00000000750D3000-memory.dmp

memory/3504-1-0x00000000750D0000-0x0000000075681000-memory.dmp

memory/3504-2-0x00000000750D0000-0x0000000075681000-memory.dmp

memory/2080-4-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2080-3-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2080-5-0x0000000000400000-0x0000000000451000-memory.dmp

memory/2080-8-0x0000000000400000-0x0000000000451000-memory.dmp

memory/3504-7-0x00000000750D0000-0x0000000075681000-memory.dmp

memory/2080-11-0x0000000010410000-0x0000000010475000-memory.dmp

memory/4904-17-0x0000000001010000-0x0000000001011000-memory.dmp

memory/4904-16-0x0000000000D50000-0x0000000000D51000-memory.dmp

memory/2080-72-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/4904-77-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 6202f7a0bc51b0b2ad72cf7a071cc419
SHA1 aa961408a5ab2ef25d48fbfddf9524f4c524a788
SHA256 6348c65ace9a2243ebc4caece3159e3b631402ebe3a8604057a95e78354076b8
SHA512 5a4285c87b6f4527c301eba8807f4926250ad19d716410c0798a354557aab77cce0af09c2f8c5f9a6da42ce20408a31bb45f197337de8ac9976e3eb5be84e89d

C:\Windows\SysWOW64\WinDir\Svchost.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

memory/2080-147-0x0000000000400000-0x0000000000451000-memory.dmp

memory/4912-148-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 4f2ad7c0891978b31a50fdff94b51f9e
SHA1 7394de12ef9719bbe5ddb927d2de9080082b1ac4
SHA256 fb02d3507339a340d09ea5ab47477c10dd5e73e70c1200dc6364402bf3038303
SHA512 ec26b8c3d11ab311e3b267341c48642bbf0822dfb72618459bac5877b3f752e18360d685cf530e9dbe0034b475e166627ca600afebe07af89d4d3118315e1e54

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 42fbfe4244411f69b486eb425487e3a4
SHA1 4994946a2b7f7dfebe2a7716b79746f9d66dfa15
SHA256 6222fbe546758808bc66803de043537c3961332d005646dd86ea70b9dc00eafe
SHA512 3b910b33b02168df542920db22825031c8ad0993e607ed30b595e674d8b99972b01157c3f0075c6f17f982fa7d56f31aa078f2a164753b7e9375e8b9153a4f52

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d44a47a83f6b9bf2823b0757185e57db
SHA1 fca25e91038553ca0e3dab9c2a93445997e1ef19
SHA256 2d005dab52c1c9319967517b0b9cec87519fb1c03d0e90293c8d51fd26b50ff1
SHA512 c45aa3b71858031caa44d65559470c3c00ae1db5ab4984d3172fc5646cc3c03bfb8be2aa55ce6bc3cfbad96812c174c94594b06339fede622b3a03583f582c9e

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7828fea121abd1223fdba1933c718438
SHA1 30bbb4a1e111f37d7cabd084bea74b137c89e16c
SHA256 cd00b0afa3f5236dbcd31c2dc7a8c1908b63fa4eb467f8757a7486060947fd0e
SHA512 2e0551d7b8bf0ef3b1682a922946d98acedfcc57c0f172b9a634eae1a94f265bf675734de3930e62d5f478cd55293d199e55076d2edcf5066d49e9c9c127e7db

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8c5dc8f152c15191ebad712ab548bc8c
SHA1 b06186af0e7dc13fb06c59ce89974b66f0abe31e
SHA256 bd88d258e4720fbd71ad69020bc9a99584ac38b87a378fef734f619ecebd3d93
SHA512 295a2e3ec2d481d1a96e1f73c7fc9168de54c9575c18ab3eaac21fcda593b67fb0ab7f96b87ed9ec4b75b9ce6ff4473d2e5298d7bd72aa4e9e9478b6884c91ba

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 50c58f79d2a13888ce9a0d184fc461c6
SHA1 cd9d89a68ca0e071b5d1cd6919eae0cf0bc57bc4
SHA256 41ce176c7925369174b9476a2ac2bfa0057d7f2c2e4cf664679f07a57ec3eb7f
SHA512 fdaabd7a2078c9534d6eeb5a7ceeacf6372a81c74019af3cc0a264cabfab3d27e8d6ad26db9d113655af47bc32b83fc3d28422dfd53a812acdfa50fb8bd95150

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7d1d0a09a534a71f3ba2db187ff3cdf9
SHA1 6cd8d0e20c0415ee25e65e4f9cb03b0bbdf7b707
SHA256 5c50fd63ca9bb58af9181b7718cf0794090ff731288509b695e331a7281f9608
SHA512 e3062dd48f8fec8c9286f68fa24bb3a3bb9ae880b0ac904dce98361671c1d825be68aefd888e55b1559120e85058f206e50659b2ec79596850634041aa396263

memory/4904-753-0x0000000010480000-0x00000000104E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 09fa72b11d35a18982af40e149f78ed5
SHA1 295a94240956cf3dbf562bac811fc749c0d1814c
SHA256 9f91e3aba04200c28f80df011289084b291396c96d955821867281749e0767a2
SHA512 ba5654cb2dda12357f3f31f8d1c5636479931d3a1ea724b10ffb97f67d065b8df339a40341d148e1a674b1432722501bd0d6406e75ddd4b45020183f5fbd6412

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d3ff54717857e2edfa78c41ab6ca3e8a
SHA1 cfadc2022ce1d828410db16c35807fd4cedf39d5
SHA256 65a056b08a9742d2cfa83319a14f05d30b333dc7a2716a2bc3275969d456bee6
SHA512 9ed8fd66fcc411845c7f9b978108d292933e8ddc16ac6ea05eebd653aadfbd52fb7db82147b9bdef0a36ed0e86902079bed6da973bae21c7d7ce0d823913f386

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 bedc068db48e422d8448bd570139a913
SHA1 c1962e095f461771f833e50d24e41a14e3f2afc3
SHA256 9f16247f721e89c0110ed7d0428e64cfbef887c0a20a9e441be229f566f2acba
SHA512 1796966037b8b512b0113bd762bdc44ad46290e5b09a374eee20f60c9af04f35427f97a7a5203d1c35d3d1fa62bff3731a505235cf068b14c8dc3e04549037c8

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 f85da90ecd73fb8c9d00cc0a63bc61af
SHA1 56b79604f81c57e316de4419c2d9f84bfb03cbed
SHA256 0a92f89b4972e31903b462272fe4f40c4afe067662ee04bd0fc6d267e9a8b695
SHA512 99097a6b002efc2791bf7c31cd90b7cd8a562a10be41ef75173490f18f79637cda45b2a1e6448fb7f7c7fc74ddb37819a75a49af7ff31158e22a55068456d383

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 e34a220ed2441233f3522dd8f3ab1a38
SHA1 b9d302781a6ea3bfb337b614be579831a44d8e2a
SHA256 ff2605c9525dbbcbc2490628551c058ba86549742e28c25a69c880b22d8528ec
SHA512 a03d92eccd84f74723c2d854b9bb0f8eab92b0b3951631fca9cf948d750cdc49eacee5e90bbcd632e0effb609dc7ef98900c35884f393ae8807ae932fb398c34

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 ea19f44b5d09cd1ca25a6cf231a9381b
SHA1 152992c3b5baa6d9e6c672e86ea6181ce2eebb8b
SHA256 e38ec81a81cc0cecf4f47a1d997f8ffee095cd128b9a80892513dd25c617ae41
SHA512 0babed0257cfa36cafbe94f8efa3d0f16c700f593f7f6ad2d04041de981f5cae1bb065fd7d00939cba30ff1b78da33ee5946573d0a04883372e04a6cc9cddee4

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 dc10077fdaf6d7d6fb8a62efe18ff5f3
SHA1 968bad759642987004e325582da056f62f80ad79
SHA256 c86802a859ff0546cfcaa4d06a6ca7f6c08dfe9f862bf1372ec52f53de5dae91
SHA512 536f7245a30a4cfa091b3e0bacbe581c645e176163a8c1ccd3853a0710c3908a045bbffc19b3570a01cf924c8a2108254ecabaa32ca19a9f84179eac4c99a527

memory/4912-1432-0x0000000010560000-0x00000000105C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 585bc2b90aff53ad08363451eed4b857
SHA1 e155742fd817a9790bbc74115489123fcd97268d
SHA256 daa1b368a9195f77ab5a9f80f2ee2324341962e399e759810ab2591e4ad97698
SHA512 0c8836a6cb650dc6d5877814255a1e782e0c5cca6655572985688211acf7abb0d48a73d707d5b7f4ded75d4f6d0ada963438bdd40e67dd34e909645d0b62b959

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2c44bb65779358202ab1d712cf8f2e85
SHA1 8233cde06292142fbf6f1889b3fd0a0079e8a7a8
SHA256 5b20197cf5186cce47c2492e3aa9142432716497b0b1adac1bf981897167fb16
SHA512 5d36cc952dcc3525d7f201a69164b2c3f30ffd2b94da5c0f73520b4a6008d74f5c63d3c732b73be8d7eaf03efbd7fea1e8e13978760f7243da5417020a5140f5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 22505a031c97314c576996131b267c85
SHA1 e0d13ff32ce25b48bc751f53b7b4b7f0f5001f2c
SHA256 2d1205800b95b75b1ef95cdf6db2f39aab3b531a21267103689d0889ec0f1fa0
SHA512 e185c9e72338193cb1cefb2fa2d6334cbaa32812785fcbee75e0642520f878f4007be9b5c862db5ccfc7f11d348ada3e773967d5107acee009989d492fd24c4d

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 fdd4050d012591f146b887236c159e8a
SHA1 88e33d8099da2da24e8e685402291bdfd647685a
SHA256 5784e49b3f109c1cdaafefc43aec149db71699c611c07b6310dbc8cd963c98d8
SHA512 251ce8872c81755d7d4ec99bc5ee85a217a112350cd0583f7cdb6ccc7b328c8782cd929926b52ddf449dd777091c3f6714cfcbb5b629e5493861d0190c082391